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ABSTRACT 

AI  planners  which  are  designed  for  rohiist  domains  must  be  alilc  to 
work  well  with  incomplete  knowledge.  In  particular,  they  must  be  able  to 
reason  about  what  they  need  to  know  in  order  to  perform  an  action,  and  how 
to  get  the  information  that  they  need.  This  paper  presents  a  formalism  wiiich 
is  expressive  enough  to  describe  these  reasoning  processes.  Wc  demonstrate 
that  for  our  purposes,  a  first  order  logic  of  knowledge  is  superior  to  a  modal 
logic  of  knowledge.  Next,  we  describe  the  paradoxes  that  result  from  a  first- 
order  approach,  and  show  how  we  can  resolve  them.  Finally,  we  present  a 
simple  model  of  action  and  propose  a  solution  to  the  knowledge  preconditions 
problem  based  on  our  integrated  theory  of  knowledge  and  action. 
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1.    Introduction 

Most  AI  planners  work  on  the  assumption  that  they  have  complete  knowledge  of  their 
problem  domain  and  situation.  Standard  AI  planning  programs,  such  as  STRIPS  [Fikes  and 
Nilsson  1971]  and  NOAH  [Sacerdoti  1977],  are  typically  presented  with  a  complete  list  of 
actions,  their  preconditions,  and  effects,  so  that  formulating  a  plan  reduces  to  searching 
through  this  pre-packaged  list  of  action  operators  for  a  detailed  action  sequence  that  will 
achieve  some  desired  goal.  While  this  model  of  planning  is  conceptually  simple  and  easy  to 
implement,  it  is  not  adequate  as  an  account  of  real  world  complex  planning.  In  actual 
planning  situations  we  often  don't  have  enough  information  when  we  start  out  to  draw  up 
completely  detailed  plans  This  is  true  of  even  simple  plans;  Robert  Moore  has  pointed  out 
[Moore  1980|  that  an  agent  may  not  even  be  able  to  specify  completely  the  steps  of  a  plan  to 
call  a  friend.  Unless  he  already  knows  the  number  by  heart,  he  must  first  look  it  up  in  the 
phone  book,  so  that  the  plan  becomes: 

1)  Look  up  the  friend's  number,  X     • 

2)  Dial  X  on  the  telephone 

Because  he  does  not  know  what  X  is  when  he  starts  out,  step  2)  Is  not  fully  specified  until 
step  1)  is  completed. 

Incomplete  knowledge  plagues  most  of  our  real  life  planning  situations,  but  we  are 
nonetheless  able  to  develop  and  successfully  execute  complex  plans.  The  trick  lies  in  our 
ability  to  draw  up  sketchy  plans  and  figure  out  ways  of  making  these  plans  concrete.  We  can 
reason  about  whether  or  not  we  have  enough  information  to  do  a  particular  action;  if  we 
don't,  we  can  plan  to  obtain  the  necessary  information,  either  by  looking  it  up  or  by  asking  a 
friend.  Or  we  can  decide  to  delegate  an  entire  subplan  to  another  agent,  if  he  knows  more 
about  the  particular  task  than  we  do.  Knowledge  acquisition  and  delegating  responsibility  are 
integral  parts  of  our  planning  processes. 

A  robust  planning  system  must  have  similar  capabilities  if  it  is  to  work  in  a  reasonably 
complex  domain.  In  particular,  it  needs  a  solid  theory  of  knowledge,  action,  and 
communication,  so  that  it  can  produce  a  coherent  plan  even  when  its  knowledge  of  the 
problem  domain  and  problem  situation  is  incomplete.  Some  work  has  already  been  done  in 
this  field,  most  notably  by  Robert  Moore  [.Moore  1980].  Moore  has  developed  a  theory  of 
knowledge  and  action  in  which  it  is  possible,  for  example,  for  an  agent  who  knows  the 
combination  of  a  safe  to  reason  that  he  knows  how  to  open  the  safe.  Agents  in  Moore's 
system  are  also  capable  of  reasoning  about  action  sequences,  so  that  an  agent  can  reason  that 
he  can  do  the  sequence  of  (read  combination  of  safe;  open  safe)  even  if  he  doesn't  know  the 
combination  of  the  safe  at  the  time  of  his  reasoning. 

Douglas  Appelt  [Appelt  1982]  has  extended  Moore's  system  to  a  multi-agent  system  in 
which   agents   cooperate   and   share    information   to   accomplish   a  single   task.     In   Appelt's 


system,  an  agent  A  can  plan  to  tell  another  agent  B  a  piece  of  information  that  B  needs  to 
carry  out  a  particular  task. 

Due  to  the  inherent  limitations  of  Moore's  formalism,  however,  neither  Moore  nor 
Appelt  can  attack  the  knowledge,  action,  and  communication  problem  m  its  full  generality. 
There  is  no  way,  for  example,  for  Moore  or  Appelt  to  describe  John's  plan  to  bake  a  cake  if 
he  himself  doesn't  know  how  to  use  an  electric  mixer,  but  does  know  that  Bill  knows  how  to 
use  one. 

This  paper  presents  a  logic  that  is  expressive  enough  to  deal  with  the  problems  that 
faced  Moore's  system.  In  the  next  section  of  this  paper,  I  review  .Moore's  work  on 
knowledge  and  action,  and  demonstrate  its  logical  limitations.  Afterwards,  I  present  an 
alternative  approach,  discuss  its  power,  and  show  how  it  can  be  integrated  with  Moore's 
work  on  knowledge  and  action.  Finally,  I  briefly  discuss  how  my  logic  of  knowledge  and 
action  can  be  extended  to  a  robust  logic  of  knowledge,  action,  and  communication. 

2.    Moore's  Logic  of  Knowledge  and  Action 


2.1.    Some  Historical  Background  and  Motivation 

Moore's  work  is  motivated  by  the  desire  to  formalize  the  interaction  between 
knowledge  and  action.    He  has  two  central  concerns: 

1-  explaining  how  an  agent  can  decide  that  he  knows  enough  to  carry  out  an  action;  i.e.,  how 
knowledge  affects  action,  and 

2-  showing  how  performing  an  action  can  change  what  an  agent  knows;  i.e.,  how  action 
affects  knowledge. 

Of  the  two  problems,  the  first  proves  to  be  the  more  difficult,  and  as  such  provides  the  focus 
for  much  of  Moore's  research.  Prior  to  his  work,  most  AI  planning  programs,  as  we  have 
mentioned,  had  glossed  over  the  problem  and  simply  assumed  complete  knowledge  of 
problem  domain  and  situation  for  all  agents.  There  was  thus  no  need  at  all  for  an  agent  to 
decide  whether  he  knew  how  to  do  a  particular  action.    He  always  did. 

The  first  tentative  attempts  at  a  theory  of  knowledge  and  action  came  from  .McCarthy 
and  Hayes  in  their  landmark  article  'Some  Philosophical  Problems  from  the  Standpoint  of 
Artificial  Intelligence.'  [McCarthy  and  Hayes  1969]  There,  McCarthy  and  Hayes  argue  that  a 
planning  program  does  need  to  explicitly  reason  about  its  ability  to  perform  an  action.  For 
example,  if  an  agent  is  forming  a  plan  to  call  another  agent  on  the  telephone,  he  must  realize 
that  he  needs  to  know  the  second  agent's  telephone  number.  Similarly,  if  an  agent  is  trying 
to  open  a  combination  safe,  he  needs  to  know  the  combination  of  the  safe. 

McCarthy  and  Hayes  did  not  attempt  to  formalize  any  general  principles  of  knowledge. 
Rather,  they  explicitly  wrote  down  knowledge  precondition  axioms  for  each  action:  to  call  a 
friend,  one  must  know  his  telephone  number,  to  open  a  safe,  one  must  know  its  combination, 
and  so  on.  Unfortunately,  there  are  two  major  problems  with  this  approach.  In  the  first 
place,  we  note  that  knowledge  precondition  axioms  are  needed  for  nearly  every  action.  This 
leads  to  an  explosion  of  axioms  in  any  robust  planning  system,  which  in  turn  leads  to 
unacceptably  long  and  slow  proofs.  Secondly,  knowledge  precondition  axioms  are 
unsatisfactory  in  that  they  have  no  explanatory  power.  That  is,  the  axioms  do  not  explain 
how  we  come  to  know  how  to  perform  an  action.  There  seems,  for  example,  to  be  a  strong 
connection  between  what  an  agent  needs  to  know  in  order  to  call  someone  on  the  phone,  and 
what  that  agent  needs  to  know  in  order  to  open  a  combination  lock.  .Moreover,  the  sort  of 
knowledge  needed  in  these  cases  seems  to  differ  markedly  from  the  knowledge  needed  by  an 
agent  who  wishes  to  drive  a  car.  In  general,  however,  knowledge  precondition  axioms  take 
no  account  of  these  connections  and  similarities. 
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We  will  be  referring  to  these  problems  under  the  umbrella  heading  of  'the  problem  of 
knowledge  preconditions.'  This  is  the  problem  that  Moore's  system  seeks  to  solve.  Rather 
than  simply  write  down  knowledge  precondition  axioms,  Moore  sought  to  develop  a  general 
theory  of  knowledge  and  action  in  which  a  few  principles  could  characterize  the  knowledge 
that  any  agent  needs  to  perform  an  action. 

2.2.    Review  of  Moore's  Work 

Traditionally,  there  have  been  two  ways  of  dealing  with  the  verb  'know"  in  standard 
logic.  We  can  regard  it  as  a  modal  operator  that  applies  to  propositions,  or  we  can  regard  it 
as  a  syntactic  predicate  that  ranges  over  names,  or  labels,  of  sentences.  Ii  we  want  to 
express  the  fact  that  John  knows  that  snow  is  white,  the  first  approach  would  lead  to  the 
expression  Know(John,  snow  is  white)  while  the  second  approach  would  lead  to  the 
expression  Know(John,  'snow  is  white'),  since  the  string  'snow  is  white'  can  be  considered 
the  unique  name  of  the  sentence:  snow  is  white.  Moore  adopts  the  first  of  these  two 
approaches,  basing  his  theory  on  the  work  of  Jaakko  Hintikka  in  the  fields  of  knowledge  and 
belief  [Hintikka  1962,1969). 

There  are  various  important  properties  of  knowledge  which  any  robus*  theory  of 
knowledge  must  capture.  Everything  an  agent  knows  must  be  true,  agents  should  know  the 
logical  consequences  of  their  knowledge,  and  so  on.  The  following  axiom  schemata 
characterize  an  agent's  knowledge  in  Moore's  system. 

Ml:  Axioms  of  ordinary  propositional  logic 
M2:  Know(A,P)  =>  P 

(V'eridicality:  Whatever  is  known  is  true) 
M3:  Know(A.P)  -  >  Know(A,  Know(A,P)) 

(Positive  Introspection:    If  an  agent  knows  something,  he  knows  that  he  knows  it) 
M4:  Know(A,  (P  =  >Q))  =  >  (Know(A,P)  =  >  Know(A,Q)) 

(Consequential  Closure:    Agents  know  all  logical  consequences  of  their  knowledge) 
M5:  If  P  is  an  axiom,  then  Know(A,P)  is  an  axiom 

(Necessitation) 

A  system  defined  by  M1-M5  is  equivalent  to  the  modal  logic  S4  as  defined  in  [Hughes  and 
Cresswell  68],  if  we  hold  the  knower  fixed  and  substitute  necessary  for  'know.' 

Moore,  however,  does  not  actually  reason  about  knowledge  and  action  within  his  modal 
framework.  Rather  than  reason  about  the  set  of  propositions  that  an  agent  knows,  Moore 
instead  reasons  about  what  is  true  in  the  possible  states  of  affairs,  or  'possible  worlds'  that 
are  compatible  with  an  agent's  knowledge.  Recasting  modal  logic  in  terms  of  possible  worlds 
is  not  a  new  notion  in  philosophy  or  logic.  Historically,  modal  operators  such  as  necessarily, 
possibly,  and  know,  have  been  explained  in  terms  of  a  possible  world  semantics.  Three 
centuries  ago,  Leibniz  defined  a  necessary  statement  to  be  one  that  was  true  in  all  possible 
worlds,  a  possible  statement  to  be  one  that  was  true  in  at  least  one  possible  world. 

More  recently,  Kripke  has  argued  that  concepts  like  necessarily  and  possibility  can  best 
be  understood,  not  absolutely,  but  in  terms  of  how  they  relate  possible  worlds  [Kripke 
1963a].  A  world  may  be  necessary  relative  to  some  possible  worlds,  but  not  to  others.  For 
example,  a  world  in  which  Socrates  dies  is  necessary  relative  to  our  world  where  all  men  are 
mortal,  but  might  not  be  necessary  relative  to  some  world  where  people  live  forever.  We 
can  introduce  an  accessibility  relation  R  that  relates  these  possible  worlds,  so  that  R(wl,w2) 
means  that  world  w2  is  necessary  relative  to  world  wl.  Kripke  has  in  fact  shown  that  by 
suitably  restricting  this  accessibility  relation,  e.g  by  positing  that  it  is  reflexive,  symmetric 
and/or  transitive,  we  can  arrive  at  all  of  the  standard  systems  of  modal  logic. 

In  much  the  same  way,  Moore  (borrowing  from  [Hintikka  1969])  defines  an 
accessibility  relation  for  the  modality  'Know',  where  K(a,wl,w2)  means  that  wl  and  w2  are 
knowledge  equivalent  from  a's  point  of  view.    If,  for  example,  John  knows  in  WO  that  snow 


4  - 


is  white,  and  wl  is  a  possible  world  where  snow  is  white,  but  w2  is  a  possible  world  where 
snow  is  green,  it  is  possible  that  K(John,WO.wl),  but  it  is  not  the  case  that  K(John,W0,w2) 
since  WO  and  w2  are  not  knowledge  equivalent  from  John's  point  of  view.  If  Fred,  on  the 
other  hand,  does  not  know  in  WO  that  snow  is  white  and  thinks  that  snow  is  green,  then  it 
may  be  possible  that  K(Fred,W0,w2). 

Moore  introduces  an  axiom  which  allows  us  to  translate  back  and  forth  between 
statements  using  'Know'  and  those  using  'K',  and  two  axioms  which  posit  the  reflexivity  and 
transitivity  of  K,  and  which  thus  capture  the  same  characterizations  on  knowing  as  M1-M5. 
These  axioms  are  presented,  in  slightly  simplified  form,  below: 

Kl:  Forall  a,p,wl  (T(wl,Know(a,p))  iff  Forall  w2  (K(a.wl,w2)  =  >  T(w2,p))) 

K2:  Forall  a,wl  (K(a,wl,wl)) 

K3:  Forall  a,wl,w2  (K(a,wl,w2)  =  >  Forall  w3(K(a,w2.w3)  =  >  K(a,wl,w3))) 

Kl  says  that  if  a  knows  that  p  in  some  world  wl,  then  p  is  true  in  every  world  that  is 
knowledge  equivalent  to  wl  from  a's  point  of  view.  Conversely,  if  p  is  true  in  every  world 
that  is  knowledge  equivalent  to  wl  from  a's  point  of  view,  then  a  knows  that  p.  It  should  be 
noted  that  this  axiom  implies  that  all  agents  know  all  facts  that  are  true  in  all  possible  worlds, 
i.e.  all  axioms.  This  is  because  if  a  statement  is  true  in  all  worlds,  the  right  hand  side  of  the 
if  and  only  if  statement  is  automatically  true.  K2  says  that  K  is  a  reflexive  relation,  and  K3 
says  that  K  is  transitive. 

Moore's  reasons  for  his  switch  into  possible  world  semantics  were  threefold.  In  the 
first  place,  he  claims  that  proving  theorems  in  terms  of  a  first  order  theory  of  possible  worlds 
is  considerably  more  efficient  than  proving  these  same  theorems  within  a  modal  logic.  In  the 
second  place,  .Moore  finds  that  the  possible  worlds  ontology  meshes  nicely  with  the  standard 
McCarthy-Hayes  model  of  actions  as  functions  on  situations,  he  merely  identifies  possible 
worlds  and  situations.  Thirdly,  some  of  the  ideas  that  philosophers  have  developed  in 
connection  with  possible  world  theories  play  an  important  role  in  Moore's  integrated  theory 
of  knowledge  and  action. 

The  most  important  of  these  notions  is  that  of  the  'rigid  designator.'  [Kripke  1972] 
Intuitively,  a  rigid  designator  designates  the  same  individual  in  all  possible  worlds.  For 
example,  Franz  Joseph  Haydn  is  the  rigid  designator  for  the  individual  who  we  know  was 
Kappellmeister  to  the  Esterhazy  family,  composed  the  Farewell,  Surprise,  and  Clock 
symphonies,  and  died  in  Vienna.  But  this  rigid  designator,  Franz  Joseph  Haydn,  would 
designate  the  same  individual  even  in  some  possible  world  where  he  would  not  have 
composed  the  Surprise  Symphony,  or  had  died  in  London.  A  rigid  designator  fixes  the 
reference  of  an  individual  in  the  actual  world  so  that  we  can  talk  about  it  in  other  possible 
worlds.  Typical  example  of  rigid  designators  are  names,  such  as  Franz  Joseph  Haydn  or 
Claude  Monet,  or  numbers. 

How  does  the  idea  of  a  rigid  designator  help  Moore  solve  the  problem  of  knowledge 
preconditions?  According  to  Moore,  an  agent  knows  how  to  do  an  action  if  he  knows  of  an 
executable  description  for  that  action.  Moreover,  we  can  in  general  say  that  we  know  who 
somebody  is  or  what  something  is  if  we  know  a  rigid  designator  for  that  person  or  thing.  For 
example,  we  know  what  Bill's  phone  number  is  if  we  know  that  460-7100  is  his  phone 
number,  but  not  if  we  know  that  his  phone  number  is  Mary's  phone  number,  because  460- 
7100  is  a  rigid  designator,  but  'Mary's  phone  number'  is  not.  In  particular,  we  know  what 
entity  an  action  refers  to,  and  thus  how  to  do  an  action,  if  we  know  of  a  rigid  designator  for 
that  action.  Since  we  also  know  how  to  do  an  action  if  we  know  of  some  executable 
description  for  that  action,  it  follows  that  a  rigid  designator  for  an  action  must  be  an 
executable  description  for  that  action.  Once  we  know  of  a  rigid  designator  for  an  action,  we 
know  all  that  we  need  to  know  to  actually  perform  that  action. 

In  practice,  how  does  an  agent  come  to  know  a  rigid  designator  for  an  action?  Moore 
argues  that  many  basic  action-types  such  as  Dial(  )  and  Move(  )  can  be  thought  of  as  rigid 
functions  in  the  sense  that  they  map  rigid  designators  onto  rigid  designators.    So  as  long  as 


5- 


we  know  rigid  designators  for  the  parameters  of  these  basic  action-types,  we  know  a  rigid 
designator  for  the  action  itself.  To  take  a  concrete  example,  we  know  how  to  do 
Dial(phone-number(Bill))  if  we  know  a  rigid  designator-  or  number  -  for  Bill's  phone 
number. 

Other  action  types  are  more  complex  and  cannot  be  thought  of  as  rigid  functions,  but 
instead,  as  small  procedures  that  are  built  up  out  of  rigid  functions.  For  example,  Puton(a,b) 
can  be  defined  as  (Movehand(Location(a));  Grasp;  Movehand(Location^Top(b))):  Ungrasp). 
Puton(a,b)  is  not  a  rigid  function  since  Location(a)  and  Location(Top(b))  can  vary  in 
different  possible  worlds.  Nevertheless,  this  definition  is  assumed  to  be  axiomatic,  so  that  all 
agents  know  it.  So  again,  knowing  rigid  designators  for  the  parameters  of  the  rigid  functions 
implies  knowing  a  rigid  designator  for  the  action. 

Moore  has  thus  characterized  the  knowledge  preconditions  for  every  single  action  with 
one  basic  principle.  We  can  now  prove,  without  adding  further  machinery,  that  John  can 
open  a  safe  if  he  knows  a  rigid  designator  for  that  safe's  combination,  that  he  can  move  an 
object  to  a  table  top  if  he  knows  rigid  designators  for  the  location  of  the  object  and  table  top, 
and  so  on.  One  axiom  has  replaced  a  potentially  huge  collection  of  knowledge  piecondition 
axioms. 

2.3.    Criticisms  of  Moore's  System: 

Unfortunately,  Moore's  system  is  beset  by  a  host  of  problems.  The  first  of  tnese  is  the 
intuitive  implausibility  of  the  argument  that  an  executable  description  of  an  action  is  a  rigid 
designator  for  that  action.  Intuitively,  a  rigid  designator  for  an  individual  seems  to  be  that 
designation  of  the  individual  that  stays  fixed  across  all  possible  worlds.  But  it  is  hard  to 
imagine  that  this  is  true  of  an  executable  description  of  an  action.  Take  thc'action  of  dialing 
460-7100  on  the  telephone,  for  example.  In  1950.  the  executable  description  for  that  action 
was:  Place  one's  finger  in  the  4th  hole  on  the  telephone  dial  and  rotate  clockwise,  place  one's 
finger  in  the  6th  hole  on  the  telephone  dial  and  rotate  clockwise,  and  so  on.  Today,  an 
executable  description  for  that  same  action  might  be:  Place  one's  finger  on  the  first  button, 
2nd  row  and  push,  place  one's  finger  on  the  last  button, 2nd  row  and  push,  and  so  on.  And 
we  can  easily  imagine  a  world  where  dial  phones  are  obsolete,  and  the  place-  finger-in-hole- 
rotate  sequence  might  be  used  to  denote  some  completely  different  action. 

Examples  such  as  these  would  seem  to  indicate  that  an  executable  description  cannot 
ever  serve  as  a  rigid  designator  for  an  action;  that,  rather,  an  executable  description  is  a 
property  of  an  action  that  varies  among  different  possible  worlds.  Given  any  executable 
description  of  an  action,  we  can  imagine  some  possible  world  in  which  that  executable 
description  would  not  work.  A  possible  response  to  this  objection  might  be  that  we  are 
using  the  word  'action'  in  too  loose  a  sense.  We  might  say,  regarding  the  1950-1986 
telephone  example,  that  dialing  on  a  rotary  phone  and  dialing  on  a  push  button  phone  are 
two  completely  different  action-types,  say  DialR()  and  DialPB().  Or  it  is  possible  that  we 
can  think  of  there  being  just  one  Dial  function  that  takes  two  arguments:  a  phone  number  and 
a  phone  type.  Then  the  1950's  phone  dialing  would  be  an  instance  of  Dial(rotary, 460-7100) 
while  today's  phone  dialing  would  be  an  instance  of  Dial(push-button, 460-7100),  so  that  in 
effect,  we  have  two  different  actions,  each  with  its  own  rigid  designator.  But  such  a  strategy 
strikes  us  as  being  forced  and  runs  counter  to  our  intuitive  notions  of  what  an  action  is.  Our 
initial  feeling  of  implausibility  remains. 

A  second  criticism  of  Moore's  system  is  that  his  assumptions  regarding  an  agent's 
knowledge  seem  excessively  strong.  In  his  system,  all  agents  know  all  axioms.  This  is  in 
general  a  dubious  characterization  of  what  agents  in  a  realistic  planning  environment  know 
and  severely  constrains  Moore's  theory  of  knowledge  and  action.  In  particular  this 
assumption  implies  that  all  agents  have  the  same  level  of  procedural  knowledge,  so  that  all  an 
agent  might  not  know  is  some  of  the  slot  fillers  in  some  action.  But  this  seems  wrong. 
Surely  there  is  a  difference  between  an  agent  who  cannot  call  up  Bill  because  he  does  not 


know  Bill's  number,  and  an  agent  who  cannot  drive  to  Buffalo  because  he  doesn't  know  how 
to  drive  a  car.  The  lack  of  knowledge  in  the  latter  case  seems  to  be  more  profound,  for  the 
agent  doesn't  even  know  the  general  procedure  that  he  must  follow  in  order  to  drive  a  car. 
He  is  not  just  missing  a  small  piece  of  information. 

Yet  Moore's  system  admits  of  no  such  distinction  Any  procedure  to  do  an  action, 
insists  Moore,  is  known;  either  because  it  is  a  trivial  procedure  like  Dial()  or  because  it  is 
defined  as  a  sequence  of  primitive  procedures  by  the  axioms. 

It  is  important  to  realize  that  it  is  impossible  in  Moore's  system  to  relax  the  requirement 
that  all  axioms  are  known  by  all  agents. [1|  It  is  not  simply  a  matter  of  weakening  M5;  the 
possible  worlds  semantics  on  'Know'  are  what  entails  this  requirement,  as  is  clear  from 
examining  Kl,  the  axiom  that  allows  us  to  translate  between  statements  using  'Know'  and 
those  using  'K'.  Any  modal  logic  with  a  possible  worlds  semantics  will  suffer  from  this 
problem. 

The  third,  and  perhaps  most  important  criticism  of  Moore's  system  is  likewise  a  general 
criticism  of  any  standard  first  order  modal  logic  of  knowledge:  it  is  simply  not  expressive 
enough  to  handle  a  lot  of  our  «;tatements  concerning  knowledge.  Moore  himself  has  pointed 
out  that  there  is  no  way  to  formalize  in  first  order  modal  logic  a  statement  such  as  'John 
knows  what  Bill  said'  without  specifying  what  it  is  that  Bill  said.  This  is  because  we  cannot 
quantify  over  sentences  in  first  order  modal  logic.  Thus,  we  cannot  formulate  such 
sentences  as  'John  doesn't  know  what  Bill  said'  or  'John  knows  that  Bill  knows  something 
that  he  doesn't  know.'  Assuming  that  knowledge  about  actions  is  in  the  form  of  statements, 
we  also  cannot  express  'John  knows  that  Bill  knows  how  to  fire  a  gun'  unless  John  himself 
knows  how  to  fire  a  gun.  Of  course,  in  Moore's  system,  such  a  situation  would  be 
meaningless  anyway,  since  all  basic  facts  about  actions  arc  known,  but  we  wish  to  develop  a 
logic  in  which  it  does  make  sense  for  agents  to  learn  procedures  for  action  from  other  agents. 

This  lack  of  expressiveness  of  Moore's  system  seems  to  be  the  most  powerful  argument 
for  an  alternate  system.  Even  if  we  ignore  the  first  two  arguments  above,  and  agree  that 
Moore  presents  the  ultimate  solution  to  the  problem  of  knowledge  preconditions,  it  is  a 
hollow  victory  if  his  system  cannot  be  extended  to  one  that  can  express  these  very  basic  ideas 
about  knowledge. 

3.    The  Alternate  Approach:  A  First  Order  Logic 


3.1.    'Know'  as  a  syntactic  predicate:  The  Montague-Kaplan  Paradox 

What  we  want,  then,  is  to  construct  a  theory  of  knowledge  that  captures  as  closely  as 
possible  Moore's  solution  to  the  problem  of  knowledge  preconditions,  but  manages  to  avoid 
the  pitfalls  outlined  above.  One  possible  strategy  might  be  to  turn  to  a  higher  order  modal 
logic  [e.g.  Gallin  1975);  such  a  system  would  be  capable  of  quantifying  over  propositions  and 
would  thus  be  expressive  enough  for  our  needs.  Such  an  approach,  however,  would  be 
unattractive  for  a  number  of  reasons.  In  the  first  place,  we  would  no  longer  have  a  complete 
proof  procedure.  Moreover,  a  higher  order  modal  logic  with  possible  worlds  semantics  still 
entails  that  all  agents  know  all  axioms,  which  was  one  of  our  primary  objections  to  Moore's 
system. 

We  thus  turn  to  the  alternate  approach  that  we  mentioned  at  the  beginning  of  the  last 
section:  treating  'know'  as  a  syntactic  predicate  that  ranges  over  names  of  sentences.    Such  an 


1-  It  might  seem  possible,  however,  to  define  a  class  of  statements  thai  are  not  axioms  and  so  are  not 
necessarily  known  by  all  agents,  but  that  remain  true  in  all  worlds  that  are  physically  accessible  from 
the  current  world  There  are  various  difficulties  with  such  a  scheme,  at  anv  rate,  there  are  more  severe 
problems  with  Moore's  system  as  we  shall  see.  so  this  doesn't  seem  to  be  a  very  worthwhile 
undertaking. 
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approach  is  very  powerful.  We  can  formulate  all  the  examples  of  the  last  section  that  gave 
Moore's  system  so  much  trouble,  and  in  a  first  order  system  as  well.  This  is  because  we  can 
quantify  over  names  of  sentences,  which  are  just  numbers,  or  strings,  rather  than  quantifying 
over  sentences  themselves.    So,  'John  knows  that  snow  is  white'  can  be  formulated  as 

Know  (John, 'snow  is  white'), 

'John  knows  what  Bill  said'  can  be  formulated  as: 

(Exists  x)  (Said(Bill,x)  and  Know(John,x)), 

'John  knows  that  Bill  knows  something  he  doesn't  know'  can  be  formulated  as 

Know(John, '(Exists  x)(Know(Bill,x)  and  'Know(John,x))),  and  so  on. 

Despite  its  superficial  appeal,  however,  treating  'know'  as  a  syntactic  predicate  leads  to 
severe  difficulties.  Richard  Montague  has  shown,  in  fact,  [Montague  1963]  that  any  system 
that  treats  'know'  as  a  syntactic  predicate  and  in  which  know'  has  some  very  general  and 
desirable  properties,  must  be  inconsistent.  [2j  This  result  is  a  direct  co:i>pijuence  of  the 
Knower  Paradox,  which  was  first  discussed  by  David  Kaplan  anJ  Richard  Montague  in  1960 
(Kaplan  and  Montague  I960].  The  Knower  Paradox,  which  can  be  regarded  as  a  variant  of 
the  Liar  Paradox,  follows  below: 

If  'Know'  is  a  syntactic  predicate,  we  can  construct,  via  Godel  numbering,  the  following 
sentence: 

(S)    Know(a, '■$•), 

i.e., 

(1)    S  iff  Know(a,'-S') 

Suppose  we  have  the  following  axioms  on  the  predicate  know: 

(I)  Know(a,'P')  =  >  P  (whatever  is  known  is  true) 

(II)  Know(a,'P')  and  Logically-Derivable(P,Q)  =  >  Know(a,'Q') 
(if  a  knows  P  and  Q  is  logically  derivable  from  P  then 

a  knows  Q;  i.e.,  agents  know  logical  consequences  of 
their  knowledge) 
(III)Know(a,(I))  and  Know(a,(II)) 

(agents  know  the  basic  principles  of  knowledge) 

Is  S  true  or  false?  If  S  is  true,  then  by  (1)  a  knows  that  not  S.  Therefore  by  (I),  not  S  must 
be  true,  i.e.  S  is  false.  This  is  a  contradiction,  so  S  can't  be  true.  Therefore  S  must  be  false. 
Since  any  agent  who  knows  the  basic  logical  axioms  on  knowledge  can  go  through  this 
reasoning,  a  can  reproduce  this  argument  (by  (II)  and  (III).  So  a  knows  that  S  is  not  true. 
But  then  by  (1),  S  is  true.    Contradiction. 

3.2.    A  Similar  Problem-  The  Liar  Paradox-  and  Tarski's  Solution 

The  first  thing  we  ought  to  notice-  if  there  is  to  be  any  hope  of  developing  a  first  order 
logic  of  knowledge-  is  the  similarity  berween  this  argument  and  Tarski's  argument  that  a 
classical  logical  language  cannot  contain  its  own  truth  predicate.  Tarski's  argument  is  based 
on  the  Liar  Paradox:  the  apparent  inconsistency  of  a  statement  such  as  'This  statement  is  a 
lie.'  Tarski  showed  that  if  'true'  is  regarded  as  a  syntactic  or  arithmetic  predicate,  we  can 
construct  a  sentence  such  as  P  iff  'True(P),  i.e. 

(P)      ■True(P) 

Obviously,  inconsistency  immediately  follows  if  we  allow  such  a  statement. 


2-  This  IS  true  of  any  predicate  having  properties  corresponding  to  those  of  vendicality,  consequeniia; 
closure,  and  necessitauon. 
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1o  avoid  the  paradox,  larski  proposed  thai  we  do  not  have  a  single  truth  predicate  in 
our  language,  but  that  instead  there  is  a  hierarchy  of  truth  predicates  T^,T^,T■^  ... 
corresponding  to  a  hierarchy  of  languages  Lf^,L^,L^  ...  At  the  bottom  of  the  hierarchy  we 
have  /-||,  which  is  built  up  out  of  the  usual  operations  of  first  order  predicate  logic  on 
primitive  predicates.  Since  such  a  language  is  incapable  of  containing  a  truth  predicate,  a 
metalanguage  Z.,  contains  a  truth  predicate  7,  for  Z.,,.  Of  course  the  metalanguage  L,  cannot 
contain  its  own  truth  predicate,  so  a  metalanguage  L,  contains  a  truth  predicate  7",  for  Z.,. 
This  process  can  obviously  be  extended  indefinitely. 

According  to  larski,  we  implicitly  use  these  different  truth  predicates  when  we  speak. 
For  example,  when  we  say  that  'It  is  true  that  'snow  is  white'  is  true,'  we  are  really  saying: 

'It  is  true^  that  'snow  is  white'  is  true^.' 

The  advantage  of  Tarski's  hierarchy  of  truth  predicates  is  that  it  completely  avoids  the  Liar 
Paradox.  Since  Z.,,  does  not  contain  its  own  truth  predicate,  we  cannot  create  a  sentence  such 
as  (P).    'True'  simply  isn't  an  available  predicate  at  that  point. 

We  might  think  it  worthwhile  to  use  Tarski's  hierarchical  approach  to  the  predicate 

'know',  constructing  3  hierarchy  of  know   predicates:  know ^ .know .^  know .^  and   insist  that 

know ^  first  be  introduced  in  L^'s  metalanguage.  Such  an  approach  would  probably  work  as 
well  as  the  hierarchy  of  truth  predicates,  and  has  in  fact  been  suggested  by  Kurt  Konolige  in 
his  theory  of  knowledge  and  action  [Konolige  1982).  It  turns  out,  however,  that  there  are 
some  serious  difficulties  with  Tarski's  strategy.  Kripke  discusses  these  problems  (Kripke 
1975|  and  also  proposes  an  alternate  solution  to  the  Liar  Paradox.  Our  strategy,  in  the  next 
few  sections,  will  be  to  study  Kripke's  solution  to  the  Liar  Paradox  and  see  how  we  can  adapt 
it  to  a  solution  to  the  Knowcr  Paradox. 

3.3.    Kripke's  Alternate  Approach  to  Truth 

Perhaps  the  most  obvious  objection  to  Tarski's  truth  predicate  hierarchy  is  the  fact  that 
most  people  don't  seem  to  implicitly  attach  any  subscript  when  they  use  the  word  'true.' 
Often,  we  don't  even  know  which  subscript  we  should  attach.  Suppose,  for  example,  that  I 
utter  the  sentence: 

(2)  Everything  Nixon  says  is  true 

If  Nixon  has  only  made  utterances  that  do  not  involve  truth-  i.e.,  that  are  in  Z-,,,  then  the 
applicable  predicate  is  true^.  But  presumably,  Nixon  has  made  utterances  like  'I  never  tell  a 
lie'  and  'The  truth  is  that  everything  McGovern  said  is  a  lie.'  The  fact  is  that  we  don't  know 
the  highest  level  of  Nixon's  utterances,  so  we  can't  assign  a  truth  predicate  to  the  occurrence 
of  'true'  in  (2).  Nevertheless,  there  are  many  circumstances  under  which  we  would  agree 
that  (2)  is  a  perfectly  reasonable  sentence. 

Moreover,  there  are  certain  sets  of  sentences  which  cannot  be  analyzed  by  Tarski's 
approach  irrespective  of  our  knowledge.    Suppose  that  John  Dean  says: 

(3)  All  of  Nixon's  utterances  about  Watergate  are  false 
and  that  Nixon  says 

(4)  Everything  Dean  says  about  Watergate  is  false. 

Clearly,  Dean  includes  (4)  in  (3)'s  scope,  and  Nixon  includes  (3)  in  (4)'s  scope.  By  Tarski's 
theory,  a  sentence  can  only  refer  to  the  truth  or  falsity  of  a  sentence  with  a  lower  'level',  so 
the  Nixon-  Dean  situation  would  be  impossible.  Yet  there  are  many  situations  where  these 
sentences  seem  reasonable  and  can  be  assigned  unambiguous  truth  values;  e.g.,  if  both  Dean 
and  Nixon  have  made  some  trivial  but  true  statement  about  Watergate  like  'The  Republicans 
broke  into  the  Democratic  party  headquarters  in  the  Watergate,'  both  (3)  and  (4)  will  be 
false.  Moreover,  even  in  situations  where  these  sentences  are  not  reasonable-  for  example,  in 
cases  where  Nixon  and  Dean  say  nothing  but  (3)  and  (4)-  we  would  still  not  want  to  exclude 
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thcm  from  our  language.     The  fact  is  that  people  do  utter  sentences  like  these  and  a  language 
which  cannot  capture  these  utterances  would  be  severely  lacking  in  expressivity. 

These  and  other  problems  have  led  Kripkc  to  develop  a  new  theory  of  truth  that  avoids 
both  the  Liar  Paradox  and  Tarski's  truth  predicate  hierarchy.  The  basic  idea  behind  Kripke's 
theory  is  that  not  every  sentence  gets  a  truth  value.  Essentially,  there  are  two  types  of 
sentences,  the  grounded  sentences  and  the  ungrounded  sentences.  Groumled  sentences  get  a 
value  of  either  true  or  false,  while  ungrounded  sentences  get  an  undefined  rruth  value,  the 
third  value  in  a  three  valued  logic. 

The  three  valued  logic  that  Kripke  uses  was  originally  developed  by  S.(\  Klecnc  in 
order  to  formalize  the  way  people  reason  with  statements  of  indeterminate  truth  value 
[Kleenc  1955].  Kleene  suggested  that  people  often  mentally  tag  statements  as  true,  false,  or 
unknown,  and  that  they  systematically  assign  one  of  these  'truth  values'  to  compound 
statements  which  are  built  up  out  of  simpler  statements.  For  example,  if  I  tag  'Reagan  is 
president'  as  true  and  'SueEllen  shot  J.R'  as  unknown,  ihcn  I  wil!  tag  the  compound 
statement  'Reagan  is  president  or  SueEllen  shot  J.R'  as  true,  but  I  will  tag  the  compound 
statement  'Reagan  is  president  and  SueEllen  shot  JR.'  as  unknown. 

Kleene  proposes  the  following  truth  tables  for  the  logical  connectives  v  and  ': 

V    I  t  1  f  I  u  '    I  t  I  f  I  u  •■■.■.■ 

t   |t|t|t  f|t|u 

f    |t|f|u 
u    I  t  I  u  I  u 


Consequently,  the  truth  tables  for  &  and  =  >  are: 

&itif|u  =>|t|f|u 

t     |t {f {u  t      {t  |f {u 

f     |f |f |u                                f       |t  |t  |t 
\    - 

ululflu  u      Itlulu 


We  furthermore  say  that  a  universally  quantified  statement,  Forall  x  P(x),  is  true  if  P(x)  is 
true  for  all  x,  false  if  there  exists  at  least  one  x  for  which  P(x)  is  false,  and  undefined 
otherwise.  Consequently,  Exists  x  P(x)  is  true  if  P(x)  is  true  for  at  least  one  x,  false  if  P(x) 
is  false  for  every  x,  and  undefined  otherwise. 

Kripke  evaluates  statements  in  his  logic  according  to  the  rules  of  these  truth  tables, 
although  his  'third  value'  is  semantically  different  from  Kleene's.  He  docs  not  assign  the 
third  value  to  statements  whose  truth  values  are  unknown,  but  to  statements  whose  truth 
values  cannot  be  decided  on,  by  the  very  nature  of  the  statement  and  its  relation  to  the  actual 
world. 

In  particular,  Kripke  sets  up  his  system  so  that  ordinary,  easily  understandable 
sentences  like  'snow  is  white'  and  it  is  true  that  'grass  is  green'  is  false'  are  grounded  and 
thus  are  either  true  or  false,  while  self  referential  statements  like: 


(5)    (5)  is  not  true 
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and 

(6)    (6)  is  true 

are  not  grounded  and  get  the  third  indeterminate  truth  value.  Sentences  like  (3)  or  (4)  may 
be  grounded  or  ungrounded,  depending  on  the  empirical  state  of  the  world. 

Like  Tarski,  Kripke  considers  a  hierarchy  of  languages.  However,  there  is  only  one 
truth  predicate  in  all  of  these  languages:  T(x).  He  explains  the  construction  of  his  hierarchy 
by  considering  how  we  might  explain  the  concept  of  truth  to  someone  who  had  never  been 
exposed  to  the  idea  before.  We  might  say  that  we  are  willing  to  state  that  a  sentence  is  true 
[false]  precisely  under  those  circumstances  when  we  are  willing  to  assert  [deny]  the  sentence 
itself.  Now,  since  the  individual  has  no  concept  of  truth,  he  would  initially  be  unable  to 
assert  or  deny  the  sentence  "snow  is  white'  is  true.'  But  he  can  initially  assert  the  sentence 
'snow  is  white',  so  upon  reflection  and  using  the  definition,  he  can  assert  "snow  is  white"  is 
true."  If  he  can  assert  this  sentence,  he  can,  upon  further  reflection,  assert  "'snow  is  white'  is 
true'  is  true'  and  so  on.  As  he  continues  through  further  rounds  of  reflection,  he  is  able  to 
assert  more  and  more  sentences. 

Any  sentence  that  eventually  gets  a  truth  value,  whether  true  or  false,  in  this  process  is 
called  grounded.    If  it  never  gets  a  truth  value,  it  is  ungrounded.    Clearly,  a  sentence  such  as 

(6)    (6)  IS  true 

will  never  get  a  truth  value  and  is  thus  ungrounded. 

Formally,  we  proceed  as  follows:  We  start  with  a  classical  first  order  language  L  and 
extend  it  to  a  language  L  by  adding  our  truth  predicate  T(x).  An  interpretation  of  T(x)  is 
given  by  the  partial  set  (5,, 50  where  5,  is  the  extension  of  l(x),  5,  is  the  antiextension  of 
T(x),  and  r(x)  is  undefined  for  entities  outside  5,1^5,.  We  let  Z.(5|,5-,)  be  the  interpretation 
of  L  which  results  from  interpreting  T{x)  by  (5, ,5,). 

The  first  language  in  our  hierarchy,  Lp,  is  defined  as  Z,(4>,({))  ■  That  is,  L^  is  the 
language  where  T(x)  is  completely  undefined.  Z,,  =  /-(J',  ,5;  ),  where  5,  is  the  set  of  codes 
(i.e.  Godel  numbers)  of  true  sentences  of  L^  and  S^  is  the  set  of  all  elements  of  our  domain 
D  which  either  are  not  codes  of  sentences  of  Lq  or  are  codes  of  false  sentences  of  L^.  This 
process  continues  as  we  construct  our  hierarchy. 

In  general,  for  each  ordinal  a,  £.„  is  defined  as  follows: 

If  a  is  a  successor  ordinal  (i.e.  there  exists  a  P  such  that  a  =  3  +  1),  then 

Z-Q  =  Z,(S|  Q,52  a),  where  5,  ^  is  the  set  of  codes  of  true  sentences  of  Lq  and  5;  „  is  the  set 
consisting  of  all  elements  of  D  which  either  are  codes  of  false  sentences  of  Lg  or  are  not 
codes  of  sentences  of  L^. 

If  a  is  a  limit  ordinal,  then 

^a  =  ^(•^i.c-^:.q)  where 

■^:.a  ^   Us<Q'^:.0- 
At  successor  levels,  we  take  the  truth  predicates  over  the  previous  level;  at  limit  levels  we 
take  the  union  of  all  sentences  declared  true  or  false  at  previous  levels. 

There  are  two  important  things  to  note  about  this  construction.  The  first  is  that  as  a 
increases,  the  extension  and  antiextension  of  T(x)  increase.  So,  once  a  sentence  gets  a  truth 
value  at  some  level  during  the  construction,  it  keeps  that  truth  value.  The  second  is  that  this 
increasing  is  not  strict.  We  will  eventually  get  to  a  level  where  no  new  sentences  are  being 
decided.  This  means  that  there  will  be  a  level  a  such  that  (5,  „,5.  „)  =  (5,  ^.  |,5;  „.  ,).  We 
will  call  such  a  ct  a  fixed  point  of  L.  The  proof  that  such  a  fixed  point  exists  is 
straightforward.    All  the  sentences  of  L  form  a  set,  which  must  have  some  cardinality  c;  that 
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IS,  the  number  of  sentences  in  L  is  c.  If  there  were  no  fixed  point,  wc  would  have  the 
sequence 

Z-nC  L,    C    ...L„  C    ... 

with  each  inclusion  being  strict.  We  would  thus  eventually  reach  a  point  at  which  we  would 
have  some  L^  with  more  than  c  sentences,  which  is  a  contradiction.  Thus  a  fixed  point  must 
exist. 

Once  we  get  to  this  level,  we  will  not  be  able  to  assign  truth  valuer,  to  any  more 
sentences,  no  matter  how  far  we  continue  the  construction.  We  now  call  any  sentence  that 
has  been  assigned  a  truth  value  in  this  process  'grounded';  all  other  sentences  are 
'ungrounded.' 

Kripke  has  thus  shown  how  to  construct  a  language  L^  which  contains  its  own  truth 
predicate  and  which  at  the  same  time  avoids  paradox. 

3.4.    Relevance  of  Kripke's  Work  to  a  Logic  of  Knowledge 

Kripke's  approach  to  truth  is  especially  interesting  to  us  at  this  point  because  it  suggests 
ways  of  avoiding  the  Montague-Kaplan  paradox.  Our  strategy  for  avoiding  such  paradoxes 
will  be  to  construct  a  language  in  which  sentences  like 

(1)    S  iff  Know(a,  ''S') 

(along  with  of  course  such  sentences  as  (5)  and  (6))  are  not  grounded. 

Like  Kripke,  we  will  construct  a  hierarchy  of  languages,  building  up  towards  a  language 
which  contains  its  own  truth  and  knowledge  predicates.  We  will  be  explaining  knowledge  as 
true  belief,  though  for  the  purposes  of  the  construction  we  could  as  well  have  taken 
knowledge  to  be  true  justified  belief.  We  adopt  the  former  strategy  purely  for  reasons  of 
simplicity.  The  only  point  crucial  to  this  construction  is  that  knowledge  not  be  taken  as  a 
primitive  concept. 

We  will  start  off  with  a  classical  first  order  language  Z.,  which  comes  with  a  fixed  set  of 
predicates  and  relations,  including  the  relation  believe(a,p)  which  means  that  agent  a  believes 
the  proposition  denoted  by  p.    Believe(a,p)  is  a  well-defined  function  on  all  numbers  p.  (3) 

Our  first  language  Lq  does  not  contain  the  concepts  of  truth  or  knowledge  so  we  can 
formulate  statements  such  as  'snow  is  white'  or  'Berlioz  is  dead,'  but  not  "snow  is  white'  is 
true'  or  'John  knows  'Berlioz  is  dead."  Of  course,  as  we  ascend  the  hierarchy,  these 
statements  will  get  a  truth  value.  In  L,  we  will  be  able  to  say  "snow  is  white'  is  true"  or 
'John  knows  'snow  is  white";  in  L^  we  will  be  able  to  say  'John  knows  "snow  is  white'  is 
true"  and  so  on. 

In  general,  we  can  say  that  for  each  (successor  ordinal)  i, 

-  Know(a,p)  has  a  positive  truth  value  in  Z.,,  i.e.  a  knows  that  p,  if 
(i)   p  has  a  positive  truth  value  in  Z.,_  I    and 

(ii)  a  believes  p 

-  Know(a,p)  has  a  negative  truth  value  in  Z.,  if 
(i)    p  has  a  negative  truth  value  in  Z.,.,    or 

(ii)  p  has  a  positive  truth  value  in  Z.,.,  but  a  does  not  believe  p 

-  Know(a,p)   has  an   undefined  truth   value  otherwise.     (In  particular,   Know(a,p)  will  be 
undefined  in  L,  if  p  is  undefined  in  Z,,_|.) 


3-  To  avoid  ihe  Believer  Paradox  that  such  a  move  entails  [Thoraason  1980],  we  reject  the  'assumption 
of  arrogance':  Believe(a,'Believe(a,pJ  =>  p'). 
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Formally,  we  proceed  as  follows: 

We  start  with  our  classical  first  order  language  L  and  extend  it  to  a  language  L  by  introducing 
the  truth  predicate  T(x)  and  the  knowledge  predicate  Know(a,x).  The  interpretation  of  T(x) 
is  given  as  before;  the  interpretation  of  Know(a,x)  is  given  by  the  partial  set  (K^,K^)  where 
K^  is  the  extension  of  [J ^  Know(a,x)  ^  (x|  Exists  a  Know(a,x)  }-  i.e..  K  is  the  set  of  all 
known  sentences,  AT-,  is  its  antiextension,  and  for  all  a,  Know(a,x)  is  undefined  for  entities 
outside  K^\^K^.  L{S^,S-,,K^,K-,)  is  the  interpretation  of  L  which  results  from  interpreting 
T(x)  by  (5|,5,)  and  Know(a,x)  by  (K^,K^).  Of  course,  Z,,i  =  L(<t),<t),<t>,(i))  since  both  T(x)  and 
Know(a,x)  are  completely  undefined  at  this  point. 

Thus  for  each  ordinal  a, 

if  a  is  a  successor  ordinal  (there  exists  a  3  such  that  a  =  P  -  1)  then 

L,  =  L(5,,„5,„,Uo^,....U.^:.n.J^here 

S|  o  and  5-,  „  are  defined  as  before,  and  for  each  a,  AT,  „  ^  is  the  set  of  codes  of  true  sentences 
e  where  6  is  true  in  Z.3  and  believe(a,8)  is  true  in  L^^  and,  for  each  a,  K^  ,  ,,  is  the  set  of  all 
elements  6  in  D  where 

[1]      e  is  the  code  of  a  false  sentence  of  Lq  or  6  is  the  code  of  a  true  sentence  of  Z,g  but 
believe(a,e)  is  false  in  /-^   or 

[2\     e  is  not  the  code  o(  a  sentence  of  Z.3. 
If  a  is  a  limit  ordinal,  let 

^a    =    ^(5|.a'^2..'U.^l.u.a'U.^:.».a). 

where  as  before,  5,  3  =    Us<a'^i.3 

•5:  a  =    Ue-a^:  3  a"'^  ^'''^'"^  ^°^  any  a, 

As  before,  we  can  show  that  the  extension  of  T(x)  and  [J ^  Know(a,x)  in  L^  is  non- 
decreasing  as  a  increases,  so  that  as  we  proceed,  more  and  more  statements  are  assigned 
truth  values.  Moreover,  we  can  prove  that  there  exists  a  fixed  point  a  such  that  the 
extension  of  T(x)  and  [J ^  Know(a,x)  remain  the  same  for  L^  and  L^.f.  We  call  a  sentence 
grounded  if  it  has  been  assigned  a  truth  value  at  L„;  otherwise  it  is  ungrounded. 

It  is  easy  to  see  that  problematic  sentences  like 

(1)    S  iff  Know(a,'-S') 

as  well  as  sentences  such  as 

(7)    Siff  Know(a,'S') 

will  be  ungrounded  in  such  a  construction,  and  that  the  Knower  Paradox  is  therefore 
resolved.  Thus  we  have  successfully  avoided  the  Kaplan-.Montague  paradox  and  have  dealt 
with  the  primary  objection  to  a  first  order  logic  that  treats   know'  as  a  syntactic  predicate. 

3.5.   Some  Unusual  Results 

It  should  be  noted  at  this  point  that  although  we  have  demonstrated  that  we  can 
construct  a  consistent  first  order  language  that  contains  'Know'  as  a  syntactic  predicate,  our 
resulting  logic  is  not  a  classical  logic.  This  is  true  of  Kripke's  system  as  well  as  ours  and  is  a 
direct  consequence  of  using  a  three  valued  logic  such  as  Kleene's.  This  is  because  we  do  not 
have  the  law  of  the  excluded  middle:  since  a  statement  can  be  true,  false,  or  of  indeterminate 
truth  value,  we  do  not  have  the  axiom  schema  p  v  'p.  It  is  simply  not  true  that  every 
statement  is  true  or  false;  ungrounded  statements  are  neither. 
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Losing  the  law  of  the  excluded  middle  has  far  reaching  consequences.  For  starters,  we 
no  longer  have  the  rules  p  =  >  p  or  (p  &  p)  since  these  are  equivalent  to  p  v  '  p.  Likewise 
we  do  not  have  the  quotation  stripper  axiom  schema  TrueCp")  =  >  p  or  the  adder  axiom  p 
=  >  True('p').  If  p  happens  to  be  ungrounded,  it  is  not  the  case  that  "True('p')  v  p  is  true  or 
that  "p  v  True('p')  is  true.  Furthermore,  it  is  not  the  case  in  our  system  that  Know(a,'p') 
=  >  p  for  all  p. 

The  situation  is  not  as  bleak  as  it  might  initially  appear,  however.  All  the  classical  laws 
of  logic  do  hold  as  long  as  we  are  dealing  with  grounded  statements,  they  only  fail  for 
ungrounded  statements.  Since  in  practice  we  will  be  dealing  only  with  grounded  statements, 
the  failure  of  the  classical  laws  of  logic  need  not  concern  us.  Moreover,  Kripke's  system  and 
our  system  both  have  the  classical  inference  rules:  True('p')/p  and  p/True('p').  Our  system 
also  has  the  inference  rule  Know(a,'p')/p. 

Nonetheless,  the  loss  of  the  laws  of  classical  logic  entailed  by  a  move  to  a  three  valued 
logic  have  prompted  a  number  of  researchers  to  reject  Kripke's  solution  to  the  Liar  Paradox. 
Don  Perils,  Anil  Gupta,  and  Hans  Herzberger  have  independently  attempted  to  resolve  the 
Liar  Paradox  within  classical  two  valued  first  order  logic  [Perlis  1981,  Gupta  1982, 
Herzberger  1982].  While  the  law  of  the  excluded  middle  does  hold  in  their  systems,  they  all 
lose  the  'meta'  law  of  the  excluded  middle:  True('p')  v  'True('p').  They  likewise  lose  the 
classical  inference  rule  p/True('p').  Whether  these  systems  can  thus  be  characterized  as 
classical  is  debatable.  They  are  nevertheless  of  theoretical  interest,  a-^d  in  particular  may 
lend  themselves  to  other  resolutions  to  the  Knower  Paradox.  [See  Asher  and  Kamp,  1986]. 

4.    A  First  Order  Theory  of  Knowledge  and  Action 

Now  that  we've  demonstrated  that  a  syntactic  treatment  of  knowledge  can  in  fact  be 
consistent,  we  can  proceed  to  develop  our  first  order  logic  of  knowledge  and  action.  Our 
ultimate  goal  is  a  comprehensive  theory  of  knowledge,  action,  and  communication,  but  in  this 
section  we  will  limit  ourselves  to  the  types  of  problems  that  Moore  considered  in  bis  system. 
In  particular,  we  will  show  how  we  can  integrate  Moore's  solution  to  the  problem  of 
knowledge  preconditions  into  our  first  order  theory,  and  demonstrate  how  agents  can  reason 
about  their  ability  to  do  an  action. 

4.1   Some  Preliminary  notation 

We  will  be  working  with  a  classical  first  order  language  with  all  the  usual  logical 
connectives  such  as  And,  Or,  Not,  =>  .  Variables  are  in  lower  case;  constants  begin  with 
upper  case  or  are  numbers.  Our  ontology  for  actions  will  be  loosely  based  on  the  temporal 
logic  developed  by  Drew  McDermon  [McDermott  1982,1985],  although  the  particular 
ontology  chosen  is  not  crucial  to  the  limited  theory  presented  here.  [4]  We  will  regard  time  as 
an  infinite  line  branching  into  the  future.  Like  the  real  number  line,  this  time  line  contains 
an  infinite  number  of  points.  Each  point  on  the  line  corresponds  to  a  state  or  situation  in  the 
world-  i.e.,  a  'snapshot'  of  the  world  at  a  given  instant  in  time.  An  interval  is  specified  by 
two  points  and  refers  to  the  time  interval  spanned  by  two  instants  of  time. 

An  action  is  defined  as  a  collection  of  intervals,  roughly  speaking,  those  in  which  the 
action  takes  place.  For  example,  'play-baseball'  is  the  set  of  all  intervals  of  minimum  length 
in  whch  baseball  is  played.  'Do'  is  a  function  which  maps  an  agent  and  an  action  into  an 
event,  the  collection  of  intervals  in  which  an  agent  does  a  particular  action.  For  example, 
Do(Susan,  play-baseball)  is  the  set  of  all  intervals  in  which  Susan  does  the  action  of  playing 
baseball.  If  we  want  to  speak  about  a  particular  instance  of  an  action  or  event,  we  specify 
the  actual  interval  in  which  it  takes  place,  e.g.,  Do(Susan,  play-baseball,  [S10,S36]).  R  is    a 


4-  The  ontology  chosen  will,  however,  be  of  critical  importance  to  the  development  of  the  theor>  of 
planning  and  action  presented  in  [Morgenstern  1987). 
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predicate  which  takes  an  event  and  two  situation*.,  and  says  that  the  result  of  the  event's 
occurring  in  the  first  situation  is  the  second  situation.  Ihus,  R(Do(John,feed(Felix- 
cat)),S2,S4)  is  true  exactly  when  S4  is  the  situation  that  results  from  John  feeding  Felix  the 
Cat  in  S2. 

In  general,  every  predicate  must  be  qualified  by  a  situation  or  interval.  Standing(John. 
S5)  means  that  John  is  standing  in  situation  S5,  while  standing(John,  [S3,S22])  means  that  he 
is  standing  during  the  entire  interval  [S3,S22].  In  practice,  if  a  predicate  is  true  over  all 
situations,  we  may  drop  the  situational  argument,  so  that  we  can  write,  for  example, 
white(snow)  instead  of  white(snow,Sll)  or  white(snow,  (S11,S15]).  This  is  just  shorthand, 
however;  white  is  still  a  two-place  predicate.  In  general,  we  will  use  T('P(xl,...,xn)',s)  and 
P(xl,...,xn,s)  interchangeably. 

4.1.2  Dealing  with  Strings 

Any  expression  x  of  Z,  can  be  mapped  into  a  string,  or  number,  that  represents  x  using 
the  Godelization  function  G.  G  can  be  any  function  that  maps  unique  expressions  of  L  into 
unique  numbers.  In  general,  we  write  G(x)  as  'x".  G  is  invertible;  given  any  string,  we  can 
recover  the  formula  it  represents. 

Assuming  a  moficl  M.  <ve  can  now  give  our  semantics  for  True  and  Know: 

(1)  M  1=  T(p)  iff  M  I-  G-l(p) 

(2)  M  1=  Know(a,p,s)  iff  M  i=  T(p)  and  M  |=  Believe(a,p,s) 

The  quotation  construct  is  one  of  the  most  important  features  of  L.  Strings  will  serve 
not  only  as  arguments  to  attitude  predicates  such  as  Know,  Believe,  and  Intend,  but  also  as 
arguments  to  communicative  acts  such  as  Request  and  L'ltcr.  In  addition,  we  will  use  strings 
to  obtain  the  expressivity  of  a  higher  order  language,  while  keeping  L  first  order.  Back  in 
Section  2,  we  saw  that  we  could  get  the  effect  of  quantifying  over  sentences  by  quantifying 
over  the  strings  that  represented  these  sentences.  Thus  we  could  say  that  John  knew 
something  that  Bill  didn't  know  by  saying: 

Exists  X    Know(John,x,s)  and  Not  Know(Bill,x,s) 

Similarly,  we  can  effectively  quantify  over  predicates  and  functions  by  quantifying  over  the 
strings  that  represent  them.  Since  strings  are  just  numbers,  we  may  quantify  over  them  in  a 
first  order  language. 

String  manipulation,  however,  turns  out  to  be  a  non-trivial  problem.  We  can  easily 
formulate  such  simple  sentences  as 

Know  (John, 'Lives(brother(Mary), Cleveland, S4)',S4) 

More  complicated  constructs,  however,  involving  quantification  into  quoted  contexts  are 
problematical. 

Suppose  we  wish  to  say,  for  example,  that  people  always  know  they're  alive.  Since  we 
want  to  make  a  universal  statement,  we  know  that  we  will  have  to  use  universal  quantifiers. 
So,  a  naive  first  attempt  might  be: 

forall  a,s  (Alive(a,s)  =  >  Know(a,'alive{a.s)',s)) 
This  is  clearly  wrong,  however;  if  we  substitute  John  for  a  and    SI  for  s,  we  get 

Alive(John,Sl)  =>  Know(John,'Alive(a,s)',Sl) 
which,  of  course,  is  nonsense  and  not  at  all  what  we  want.    We  want  to  get  the  effect  of 
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Know(John,'Alive(John,Sl)",Sl) 

Know(John,'Alive(John,S33)',S33) 

Know(Mary,'Alive(Mary,S33)\S33) 

and  so  on,  but  of  course  we  wish  to  state  the  principle  as  one  universal  statement. 

The  problem,  of  course,  is  that  we  can't  quantify  into  quoted  contexts;  the  quotes  are  in 
some  sense  opaque.  Still,  in  order  to  achieve  full  expressivity  for  L,  we  will  need  the  ability 
to  pull  apart  and  put  together  strings  in  arbitrary  manners.  The  three  functions  of  L 
introduced  below  help  us  achieve  that  purpose.  The  first  and  third  map  strings  into  strings; 
the  second  maps  terms  into  strings: 

(1)  concat.  concat  denotes  the  concatenation  function  of  L:  it  takes  any  number  of  strings  as 
its  arguments  and  returns  as  its  value  a  single  string,  formed  by  joining  all  the  argument 
strings  together.    So,  for  example, 

concat('Hef','far,'ump')  =  'Heffalump' 
concat('At(X,Y,','S)')  =  'At(X,Y,S)' 

(2)  name-of.  The  name-of  function  maps  a  term  into  a  string  which  uniquely  names  that 
object.  Although  the  name-of  function  is  a  bit  of  an  idealization,  we  justify  its  existence  in  L 
by  noting  that  in  everyday  usage,  for  every  term  of  L  referring  to  an  actual  object,  there 
usually  exists  exactly  one  constant  which  designates  that  term.  [5j  For  example,  the  constant 
Ronald  Reagan  uniquely  designates  the  term  president(U.S.,  1986)  [6],  the  constant  Sarah 
Ferguson  uniquely  designates  the  term  bride(Prince-Andrew, 7-23-86).  The  name-of  function 
returns  the  Godel  function  of  the  constant  that  designates  the  term.   Thus: 

name-of(president(U.S.,]986))  =   'Ronald  Reagan' 
name-of(bride(Prince  Andrew, 7-23-1986))  =  'Sarah  Ferguson' 
name-of(brother(Mary))  =   'Bill' 
name-of(John)  =  'John' 

Note  that  the  name-of  function  applied  to  a  constant  always  yields  the  quoted  constant. 

(3)  g.  The  g  function  takes  a  string  as  its  argument  and  returns  that  string,  quoted,  as  its 
result.  For  example, 

g('John')  =  "John" 
g('brother(Mary)')  =  "brother(Mary)" 

g  can  be  thought  of  as  a  partial  reflection  of  G  into  L.  g  is  of  course  not  as  general  as  G;  it  is 
defined  only  on  strings. 

We  use  g  when  we  wish  to  talk  about  the  construct  of  quotation  with  L.    Its  usefulness 
will  be  shown  below. 

These  three  functions  combine  to  give  L  full  expressivity.    For  example,  we  can  express 
the  fact  that  all  agents  know  that  they  are  alive  in  the  following  manner: 

forall  a,s  (Know(a,  concat('Alive(',name-of(a),',',name-of(s),')'),s) 

If  we  substitute  John  for  a  and  SI  for  s,  this  now  works  out  correctly: 


5-  Of  course,  this  is  nol  always  the  case  The  classic  counterexample  is  that  of  the  planet  \'enus.  which 
has  two  constants  designating  it:  Hesperus  and  Phosphorus.  If  we  wish  L  to  be  able  to  handle  such 
cases,  we  could  make  name-of  a  multi-valued  function.  In  that  case  name-of  would  evaluate  to  one  of 
the  strings  naming  the  object  To  simplif\  the  presentation  here,  however,  we  make  name-of  a 
genuine  single  valued  funaion 

6-  We  ignore  the  obvious  problem  presenied  b>  such  terms  as  President(U.S..1980)  or  even 
President(U.S. 1-21-1980)  by  noting  that  the  temporal  argument  used  here  is  simply  too  coarse- 
grained. 
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Know  (John,  concat('Alivc(', 'John',',', 'SI ',')'), SI) 
which  is 

Know(John,'Alive(John,Sl)',Sl) 

which  is  precisely  what  we  want. 

For  another,  slightly  more  complicated  example,  we  express  the  principle  of  positive 
introspection:  if  an  agent  knows  something,  he  knows  that  he  knows  it.    In  L,  this  becomes: 

forall  a,p,s    (Know(a,p,s)  =  > 

Know(a,concat('Know(',name-of(a),',',g(p),',',name-of(s),')'),s) 

As  should  be  evident  by  now,  saying  reasonably  simple  things  in  L  quickly  becomes 
unreasonably  complicated.  The  concat  notation  is  fundamentally  clumsy;  it  is  difficult  to 
read,  write,  and  understand.  We  need  some  way  of  capturing  in  L  the  ease  of  indirect 
quotation  which  occurs  with  such  frequency  in  natural  language.  We  accomplish  this  by 
introducing  three  abbreviators  which  are  defined  in  terms  of  concat,  name-of,  and  g.  These 
abbreviators  are  all  anti-quote  operators:  their  occurrence  within  a  quoted  string  is  a  signal  to 
take  as  unquoted  the  terms  following  the  operator.    These  operators  are  discussed  below: 

(a)  the  '  *  abbreviator.  The  *  "  abbreviator  is  used  when  we  wish  to  quantify  over  strings  into 
a  quoted  string.  For  example,  suppose  we  wish  to  say  that  the  last  letter  of  the  last  name  of 
the  current  president  is  'n".   The  correct  but  cumbersome  way  to  express  this  is: 

exists  p  (last-name(president(U.S.,1986))  =  concat(p,'n')) 

In    order    to    do    away    with    the    clumsy   concat   construction,    we    introduce    the    antiquote 
abbreviator   "   ',  where   for   all   p,   the  occurrence  of  'p'  within   quotation   marks  tells  us  to 
substitute  the  expression  that  p  represents  inside  the  string.    1  hat  is,  any  string  of  the  form 
'a'p"b'  should  be  understood  to  mean  concat('a',p,'b'). 
If,  for  example,  p  is  'xyz',  'a*p"b'  is  'axyzb';  if  p  is  'q',  'a'p'b'  is  'aqb'. 

We  may  now  rewrite  our  axiom  as 

exists  p  (last-name(president(U.S.,  1986))  =   ''p'n') 

Note  that  '  *  is  not  a  symbol  of  L.  Thus  "p'n  is  not  an  expression  of  L,  and  G{*p*n)  is 
meaningless.    The  '  '  functions  simply  as  an  abbreviation. 

The  *  abbreviation  symbol  appears  in  pairs.  In  general  we  antiquote  what  we  find 
between  the  odd  numbered  and  even  numbered  occurrences  of  *  and  quote  what  we  find 
between  the  even  numbered  and  odd  numbered  occurrences  of  '. 

Thus,  in  exists  p,q,r  (r  =  'pq'p'q'q'p'q')),  the  first  and  third  occurrences  of  p  are  quoted, 
the  second  is  antiquoted;  the  first  and  second  occurrences  of  q  are  quoted,  the  third  and 
fourth  are  antiquoted. 

(b)  the  !  !  abbreviator.  Like  the  "  *  abbreviator,  the  !  !  abbreviator  is  used  when  we  wish  to 
quantify  into  strings.  However,  it  is  interpreted  differently.  If  p  is  'xyz',  'a'p'b'  is  'axyzb', 
while  'a!p!b'  is  'a'xyz'b'.  That  is,  when  we  see  "p",  we  substitute  the  expression  that  p 
represents,  when  we  see  !p!  we  substitute  p  itself.  Any  string  of  the  form  'a!p!b'  can  be 
defined  as:  concat('a',g(p),'b').    In  fact,  we  can  define  !p!  as  "g(p)". 

The  !  !  abbreviator  is  useful  when  we  wish  to  refer  to  entire  propositions  within  a 
quoted  context.  For  example,  suppose  we  wish  to  state  the  principle  of  positive 
introspection,  applied  to  John  in  situation  SI:  If  John  knows  p,  then  he  knows  that  he  knows 

P 

We  write 

forall  p  (Know(John,p, SI)  =>  Know(John,'Know(John,!p!,Sl)',Sl)) 

If   p  is  'White(Snow)'  this  expands  to 
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Know(John,"White(Snow)",S])  =  >  Know(John,'Know(John,'White(Snow)'.Sl)',Sl) 
which  is  what  we  want. 

Had  we  used  the  *  instead  of  the  !,  we  would  have  obtained: 

Know(John,'White(Snow)\Sl)  =  >  Know(John,'Know(John,White(Snow),Sl)',S]), 
which  is  ill-formed  and  thus  meaningless. 

(3)  the  (a    abbreviaior.    The  (a    abbreviator  is  used  when  we  wish  to  refer  to  the  standard 

name  of  an  object  withm  a  string.    When  applied  to  an  object  (constant  or  term)  it  returns  the 

standard  name  of  the  object,  antiquoted.    Thus  'a(g  xb"  is  to  be  understood  as 

concat('a',name-of(x),'b"). 

Thus,  the  general  principle  of  positive  introspection,  that  if  an  agent  knows  p,  he  knows  that 

he  knows  p,  can  be  expressed  as: 

forall  a,p,s 
Know(a,p,s)  =>  Know(a,'Know(@a,!p!,@s)',s) 

If  a  is  John,  p  is  'White(Snow)'  and  s  is  SI,  this  expands  to 

Know(John,'White(Snow)\Sl)  => 
Know  (John, 'Know  (■name-of(  John)',  !p!,*name-of  (SI)')', SI) 

which  expands  to 

Know(John,'White(Snow)',Sl)  => 
Know(John,'Know(John,'White(Snow)',Sl),Sl). 

4.2    The  Actual  Theory 


4.2.1     Axioms  on  Knowledge 

We  can  now  present  some  axiom  schemata  that  capture  our  basic  intuitions  on 
knowledge.  Not  surprisingly,  these  schemata  are  rather  similar  to  Moore's  M1-M5;  whether 
we  treat  'know'  as  a  modal  operator  or  as  a  syntactic  predicate,  our  basic  intuitions  on 
knowledge  remain  the  same.  It  should  be  noted  that  the  schemata  below,  particularly  K2-K4, 
hold  only  for  grounded  statements. 

Kl:  Axioms  of  ordinary  predicate  logic        (see  [Mendelson  1964],  Section  2.3) 
K2:  Know(a,p,s)  =  >  p  (veridicality) 

K3:  Know(a,p,s)  =>  Know(a,'Know(@a,!p!,@s)',s))  (positive  introspection) 
K4:  Agents  know  the  rules  of  inference: 

(i)  Know(a,'!p!  =>  !q!',s)  and  Know(a,p,s)  =>  Know(a,q,s) 
(Modus  Ponens) 

(ii)  Know(a,'p',s)  =>  Know(a, 'Forall  x  (p)',s) 
(Generalization) 
K5a:If  p  is  an  axiom  of  predicate  logic  then  Know(a,p,s)  for  any  s 
K5b:Know(a,Kl-K5b,s)  for  any  s 

It  will  be  noticed  that  K1-K5  differ  from  M1-M5  in  two  important  ways: 

(1)  Kl  and  K4  are  quite  a  bit  stronger  than  their  counterparts,  M1-M4.  Ml  and  M4  just 
specify  that  all  axioms  of  prepositional  logic  are  in  the  system  and  that  agents  can  and  do  use 
the  rule  of  inference  Modus  Ponens.  Thus,  the  system  supports  only  inferences  made  via  the 
rules  of  propositional  logic,  and  assumes  that  agents  are  limited  to  these  inferences  as  well. 
In  contrast,  Kl  specifies  that  all  axioms  of  predicate  logic  are  in  the  system,  and  K4  posits 
that  agents  can  and  do  reason  with  the  rules  of  inference  of  predicate  logic.  [7]  Our  system  is 


7-  Of  course,  the  axioms  and  inference  rules  are  not  fixed;  we  raa\  decide  to  use  a  different  set,  such 
as  is  presented  in  [KJeene  1955],  or  choose  a  natural  deduction  system,  as  in  [Mates  1972].  where  there 
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thus  considerably  more  powerful.  Traditionally,  modal  logic  has  restricted  itself  to  the 
prepositional  calculus  since  the  introduction  of  quantifiers  poses  so  many  problems  ((Marcus 
1971J,  [Kaplan  1971],  (Hughes  and  Cresswell  1968]).  Of  course,  not  much  can  be  said 
without  predicate  calculus;  Moore's  system,  however,  lets  in  predicate  calculus  through  the 
back  door  sin^e  the  actual  proofs  of  theorems  are  carried  out  in  the  first  order  theory  of 
possible  worlds.  We,  on  the  other  hand,  have  to  explicitly  assert  all  the  axioms  of  predicate 
calculus  and  assume  that  all  agents  can  and  do  reason  with  these  principles.  These  axioms  are 
strong  enough  to  prove  that  all  agents  know  all  logical  consequences  of  their  knowledge,  and 
that  they  thus  behave  like  'perfect  reasoners.' 

(2)  On  the  other  hand,  K5  is  a  good  deal  weaker  than  M5.  As  we  have  said  previously, 
we  do  not  wish  to  assume  that  all  agents  know  all  axioms,  since  there  are  many  axioms  on 
the  world  that  agents  simply  aren't  aware  of.  We  do,  however,  wish  to  assume  that  all 
agents  know  all  axioms  of  logic  and  the  basic  axioms  of  knowledge.  K5a  and  K5b  capture 
these  constraints,  thus  avoiding  the  overly  strong  assumptions  on  knowledge  that  modal 
logics  and  possible  worlds  semantics  entail. 

4.2.2     Solution  to  the  Knowledge  Preconditions  Problem 

We  are  now  ready  to  tackle  the  central  problem  of  our  theory:  When  can  we  say  that  an 
agent  knows  how  to  do  an  action? 

Moore  proposed  that  an  agent  knows  how  to  do  an  action  if  he  knows  an  executable 
description  for  the  action,  or  by  implication,  if  he  knows  a  rigid  designator  for  the  action. 
We  argued  in  section  2  that  while  the  first  condition  is  reasonable,  the  second  seems 
implausible.  There  is  a  certain  sense,  nonetheless,  in  which  Moore's  proposal  docs  capture 
some  of  our  intuitions  about  knowledge  and  action.  .Moore,  it  will  be  remembered,  believed 
that  most  simple  action-types  are  rigid  functions,  or  basic  procedures  that  any  individual 
knows  how  to  perform.  So  an  individual  can  do  a  simple  action  if  he  knows  rigid  designators 
for  the  parameters  of  the  action.  Furthermore,  complex  actions-types  are  built  up  out  of 
primitive  action-types  in  ways  that  are  known  to  every  agent,  so  that  knowing  how  to  do  a 
complex  action  also  reduces  to  knowing  rigid  designators  for  parameters  of  basic  action- 
types. 

It  seems  clear  that  there  is  some  truth  to  this  theory.  It  is  true  that  all  agents  know  how 
to  perform  certain  primitive  action-types  such  as  lift  or  carry,  and  that  they  know  how  to  do 
the  particular  action  lift(x)  if  they  know  some  fixed  object  or  'rigid  designator'  for  x.  It  is 
not  true,  however,  that  every  agent  knows  how  complex  action-types  are  built  up  out  of 
primitive  action-types.  For  example,  we  can  think  of  the  complex  action-type 
sharpen(pencil, sharpener)  as  being  defined  as: 

sequence(place-in(pencil, sharpener),  rotate(pencil)) 

where  place-in  and  rotate  are  primitive  action-types.  But  we  cannot  assume  that  every  agent 
knows  this  procedure;  in  particular,  children  don't  learn  it  until  they're  three  or  four,  and 
people  from  distant  civilizations  may  be  completely  unfamiliar  with  the  procedure.  We 
could,  however,  say  that  an  agent  knows  how  to  sharpen  a  pencil  if  he  knows  the  basic 
procedure  and  moreover  knows  fixed  objects-  or  constants-  for  the  pencil  and  sharpener. 

We  are  saying,  then,  that  an  agent  knows  how  to  do  an  action  if 

(a)  the  action  type  is  primitive  and  he  knows  constants  for  the  parameters  of  the  action 
or  if 

(b)  he   knows   how   the   action   is  built   up  out  of  simpler  actions   and  he  knows  how   to 
perform  those  simpler  actions. 


are  no  logical  axioms,  but  more  rules  of  inference.    For  ease  of  presentation,  we  have  chosen  a  system 
with  the  minimal  number  of  inference  rules 
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We   set  down  our  axioms  for   Know-how-to-pcrform   below.     Most  of  the  primitives 

which    appear    in    these    axioms,    such    as    sequence(al an)    or    while{p,acl)    are    self 

explanatory.  The  predicate  stidstr(  )  ranges  over  strings  and  is  true  of  a  string  if  and  only  if 
the  string  is  the  quoted  form  of  a  standard  identifier  of  L.  In  general,  stidstr(p)  iff  exists  x 
(name-of(x)  =  p).  Thus,  stidstr('Mary")  and  stidstr('123')  are  true;  stidstr('brother(Mary)') 
and  stidstr('telephone-number(Mary)')  are  false. 

KPl: 

k-h-t-p(a,'(a  f((a'argl,...,@  argn)',s) 
if 

primitive-action(f)  and 
exists  pi  (stidstr(pl)  and  Know(a,'equal(*pr,(a  argl,@  s)',s) 

and and 

exists  pn  (stidstr(pn)  and  Know(a,'equal(*pn',@argn,@  s)',5) 

KP2: 
k-h-t-p(a,'(a  f(@argl,...,@argn)') 
if 

exists  f*,argl*, ,argm* 

Know(a,'(((aT((aargl,...,(aargn)  =   @f(@argl* @argTn*)',s1 

and  k-h-t-p(a,'(af' ((a  argl *,..., @argm*)')) 


KP3: 
k-h-t-p(a,'seq.("actr,*act2")',s) 
if 

k-h-t-p(a,actl,s)  and 
R(Do(a,actl).s,s')  => 
k-h-t-p(a,act2,s*)  ' 


KP4: 

k-h-t-p(a,'cond(p,*actr,"act2")',s) 

if 

Know(a,'p',s)  and  k-b-t-p(a,actl,s) 
or  Know(a,''p',s)  and  k-h-t-p(a,act2,s) 


KP5: 

k-h-t-p(a,'while(p,'act*)',s) 
if 

k-h-t-p(a,'cond(p,seq(*act',while(p,'act'),nil))',s) 

Note  that  in  our  system,  as  in  Moore's,  an  agent  need  not  be  able  to  perform  an  entire 
action  sequence  when  he  starts  out  doing  an  action.  Instead,  he  can  pick  up  information  as 
he  goes  along.  So  to  do  the  action  sequence  (Look  up  Bill's  phone  number, X;  Dial(X)  ),  it  is 
not  necessary  than  John  be  able  to  perform  Dial(X).  In  fact,  he  will  not  be  able  to  do  this 
action  when  he  starts  out,  because  he  won't  know  a  constant,  or  number,  for  X.  He  will, 
however,  be  able  to  perform  Dial(X)  as  soon  as  he  completes  Look-up(Biirs  phone  number) 
and  this  is  all  that  we  require.  Agents  must  be  able  to  execute  each  step  in  an  action 
sequence  as  they  get  to  that  step. 

We  also  define  the  predicate  Know-how-to-achieve,  which  enables  an  agent  to  reason 
about  accomplishing  a  particular  goal. 
Informally,  an  agent  knows  how  to  achieve  a  situation  with  a  certain  property,  if  he  knows 
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of  some  act  that  will  achieve  the  desired  situation,  he  knows  that  the  physical  preconditions 
of  that  action  are  satisfied,  and  he  knows  how  to  perform  the  action.  The  axiom  below 
introduces  the  primitive  Precondsat.  Precondsat(do(a,act),sl)  is  true  if  the  physical 
preconditions  for  a"s  performmg  the  action  act  are  satisfied  in  si. 

KAl: 

Forall  a,p,sl 

Know-how-to-achieve(a,p.sl)  if 
exists  act 

Know(a, 'Forall  s2  (R(do((a  a,"act'),(a  sl,s2)) 
=  >  T(p,s2)) 
and 

Precondsat(do((a  a,*act*),^,  si)  ',   si) 
and    Know-how-to-perform(a,act,sl) 

These  six  axioms  suffice  to  completely  describe  the  circumstances  under  which  an  agent 
can  do  an  action  or  achieve  some  goal.  There  is  thus  no  need  in  our  system  for  specific 
knowledge  precondition  axioms.  We  have  developed  a  concise  theory  of  knowledge  and 
action  that  explains  what  it  means  for  an  agent  to  do  an  action.  The  theory  works  for  all 
sorts  of  actions,  of  arbitrary  complexity,  and  in  particular,  easily  handles  all  of  the  standard 
planning  problems  for  which  Moore's  system  was  developed  (See  Appendix).  Moreover,  we 
can  easily  describe  situations  in  which  not  every  agent  knows  how  to  do  a  certain  procedure. 
We  are  thus  able  to  capture  varying  levels  of  knowledge  among  different  agents. 

5.  Conclusion 

As  we  have  said,  our  ultimate  goal  is  to  construct  a  robust  theory  of  knowledge,  action, 
and  communication.  Thus  far,  we  have  concentrated  on  developing  a  theory  of  knowledge 
and  action,  and  have  ignored  the  communication  issue  entirely.  At  the  very  least,  we  can 
show  that  our  system  subsumes  Moore's  in  the  sense  that  it  can  handle  all  of  his  benchmark 
problems. 

Does  our  theory  of  knowledge  and  action  in  fact  have  any  advantage  over  Moore's? 
We  believe  that  it  does.  Our  theory  can  be  extended  in  a  natural  way  to  a  broader  theory  of 
knowledge,  action,  and  communication  in  which  an  agent  can  reason  about  other  agents' 
knowledge  and  plan  to  obtain  and/or  give  over  information  to  these  agents.  There  are 
several  reasons  for  believing  this  to  be  so. 

[1]  Agents  in  our  theory  have  genuinely  differing  levels  of  procedural  knowledge.  One 
agent  may  be  capable  only  of  performing  primitive  actions;  another  may  have  extensive 
procedural  knowledge  and  be  able  to  bake  a  cake,  sew  on  a  button,  or  change  a  light 
bulb. 

[2]  Agents  in  our  theory  can  reason  about  other  agents'  knowledge.  This  is  true  even  when 
an  agent  has  only  a  vague  idea  of  what  the  more  knowledgeable  agents  knows.  If 
John's  culinary  efforts  have  thus  far  been  limited  to  Duncan  Hines,  but  he  knows  that 
his  friend  Bill  is  a  master  chef,  he  can  still  reason  that  Bill  knows  how  to  bake  a  cake. 
Our  theory  can  describe  this  knowledge  as  Know(John, '(Exists  p)(  Know(Bill,  p)  and 
Describes(cake-baking,p))')),  which  might  be  the  first  step  in  John's  plan  to  learn  how 
to  bake  a  cake. 

[3]  Strings  are  a  natural  and  important  part  of  our  theory.  This  will  prove  useful  in 
developing  any  theory  of  communication,  since  so  many  communicative  actions  such  as 
ask,  utter,  hear,  and  promise  operate  primarily  on  strings.  Moreover,  since  an  agent's 
knowledge  about  actions  is  in  the  form  of  strings,  it  should  be  easy  to  describe  how  an 
agent  teaches  another  agent  how  to  do  an  action. 
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None  of  this  suggests  that  developing  a  theory  of  communication  will  be  an  easy  or 
trivial  task.  There  are  many  issues  that  will  have  to  be  worked  out  before  we  can  tackle  even 
an  easy  problem  such  as  our  thumbs-in-the-kitchen  John's  plan  to  learn  how  to  bake.  We 
will  have  to  formalize  the  relationship  between  knowledge  and  communication,  indicating 
how  knowledge  constrains  the  contents  of  communications,  and  how  communication  can 
affect  an  agent's  knowledge.  We  will  have  to  describe  the  interrelationships  among  friendly 
agents  and  the  protocols  that  these  agents  obey.  For  more  comple?:  plans,  we  will  have  to 
allow  hierarchical  environments  in  which  an  agent  may  dominate  a  number  of  subordinate 
agents,  who  may  be  more  knowledgeable  than  he  is.  As  we  continue  to  consider  the  types  of 
plans  that  our  system  should  handle,  the  requirements  for  our  theory  will  grow,  and  our 
projected  theory  becomes  more  complex. 

Nonetheless,  our  observations  do  suggest  that  our  current  theory  of  knowledge  and 
action  can  be  extended  to  a  considerably  complex  theory  of  communication.  We  have  thus 
far  constructed  only  the  core  of  a  larger  theory,  but  it  is  flexible  and  robust  enough  to  allow 
for  development  and  expansion  in  many  directions. 
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Appendix 


In  his  1980  thesis,  Moore  demonstrated  that  his  logical  formalism  could  effectively 
handle  three  benchmark  problems  concerning  the  interrelated  effects  of  knowledge  and 
action.  Here,  we  show  that  our  system  is  capable  of  handling  those  same  problems  in  an 
efficient  manner,  and  thus  that  in  some  sense  our  system  subsumes  his. 

First,  we  present  a  short  summary  of  the  three  benchmark  problems.  The  interested 
reader  is  referred  to  [Moore  80]  for  more  details. 

(1)  We  wish  to  show  that  an  agent  can  do  an  action  if  he  knows  fixed  objects  (rigid 
designators  in  Moore's  system;  standard  identifiers  in  ours)  for  the  parameters  of  the 
action,  and  that  he  can  achieve  a  goal  if  he  knows  of  some  action  to  achieve  that  goal 
and  can  do  the  action.  In  particular,  we  show  that  if  John  knows  standard  identifiers 
for  a  particular  safe  and  for  the  combination  of  that  safe,  that  he  can  dial  the 
combination  of  the  safe,  thus  opening  the  safe. 

(2)  We  wish  to  formalize  the  notion  of  a  test.  Generally,  a  test  is  an  action  that  results  in 
our  knowing  whether  a  particular  condition  is  true  or  not.  For  example,  if  we  do  not 
know  whether  a  particular  solution  is  acid  or  base,  we  can  test  it  by  performing  the 
action  of  inserting  litmus  paper  into  the  solution.  If  we  know  how  the  acidity  of  a 
solution  affects  the  color  of  litmus  paper,  we  will  know  after  we  perform  the  action 
whether  or  not  the  solution  is  acidic.  If  the  action  results  in  the  litmus  paper  turning 
pink,  the  solution  is  acid;  if  the  litmus  paper  turns  blue,  the  solution  is  base. 

Here,  we  show  that  John  can  determine  whether  a  particular  number  is  the  combination 
of  a  safe  by  performing  the  test'  of  dialing  the  combination  on  the  initially  closed  safe. 
If  the  safe  opens,  then  John  knows  that  he  did  in  fact  dial  the  combination;  if  it  remains 
closed,  he  knows  that  the  number  he  dialed  was  not  the  combination. 

(3)  Finally,  we  show  that  John  can  perform  a  sequence  of  actions,  even  if  initially  he  cannot 
perform  every  action  in  the  sequence.  We  show  that  even  if  John  does  not  know  the 
combination  of  a  safe  when  he  starts  out,  he  can  perform  the  sequence  of 
Read(paper);Dial(combination),  if  the  combination  of  the  safe  is  written  on  the  piece  of 
paper. 

The  basic  kernel  of  our  theory-  the  axioms  on  Know-how-to-perform  and  Know-how- 
to-achieve-  have  been  presented  in  the  paper.  Below,  we  introduce  a  number  of  useful 
general  axioms,  and  then  proceed  to  give  the  domain  axioms  on  dialing,  reading,  and  the 
like. 

El:  Forall  x,s 
Equal(x,x,s) 

E2:  Forall  a,s 

Know(a,El,s) 

El  states  that  every  object  is  always  equal  to  itself;  E2  states  that  all  agents  know  El. 

Al:  Forall  a,loc,s 

At(a,loc,s)  =>  Know(a,'At((a  a,(a  loc,@s)',s) 

Al  is  a  useful  simplification  which  states  that  agents  always  know  where  they  are. 
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II:  Forall  a, act, si, s2 

Intend(a,Do(a,act),sl)  and  R(Do(a,act),sl,s2)  => 
Know(a,'R(do((a  a, (a  act),(a  sl,(a  s2)',s2) 

II  says  that  if  an  agent  intends  to  do  an  action  and  does  it,  then  he  knows  in  the  resulting 
situation  that  he  has  done  the  action. 

We  now  present  some  axioms  on  Dial.  Dial  is  a  two  place  function  taking  a 
combination  to  be  dialed  and  a  safe  upon  which  the  combination  is  dialed.  These  are  just 
Moore's  axioms  recast  mto  our  formalism. 

Dl:  Forall  a,xl,x2,s 

Precondsat(Do(a,Dial(xl,x2)),s)  <  =  >  At(a,x2,s) 

D2:  Forall  a,xl,x2,sl,s2 

R(Do{a,Dial(xl,x2)),sl,s2)  => 
Equal(xl,comb(x2),sl)  =>  Open(x2,s2)  and 

Not  Equal(xl,comb(x2),sl)  and  Not  Open(x2,sl)  -  >  Not  Opea(x2,52)  and 
Open(x2,sl)  =>  Open(x2,s2) 

D3:  Forall  a,xl,x2,sl,s2 

R(Do(a,DiaI(xl,x2)),sl,s2)  => 

Open(x2,s2)  =>  Know(a,  'Open(@x2,@s2)',s2)  and 
Not  Open(x2,s2)  =  >  Know(a,  'Not  Open((a  x2,@s2)',s2) 

D4:  Forall  a.xl.xZ.sl ,s2 

R(Do(a,(Diai(xl,x2)),sl,s2)  => 
Forall  p 

p  /=  'Open((a  x2)'  and  p  /=  'Not  Open(@  x2)'  =  > 
T(p,sl)    <  =  >  T(p,s2) 

D5:  Primitive-Operation('Diar) 

Dl  says  that  the  physical  precondition  for  opening  a  safe  is  being  at  the  same  location  as 
the  safe.  D2  describes  how  dialing  a  number  on  a  safe  affects  the  safe.  If  the  safe  is  open,  it 
remains  open.  If  the  agent  dials  the  combination  of  the  safe,  the  safe  is  open  as  a  result.  If 
the  safe  is  initially  closed  and  the  number  the  agent  dials  is  not  the  combination  of  the  safe, 
then  the  safe  is  closed  after  the  agent  finishes  dialing.  D3  says  that  after  an  agent  finishes 
dialing,  he  knows  whether  the  safe  is  open  or  not.  D4  is  a  frame  axiom  and  states  that  all 
statements  that  are  true  before  dialing  are  true  after  dialing-  with  the  obvious  exceptions,  of 
course,  of  statements  that  say  whether  or  not  the  safe  is  open.  Naturally,  these  may  change 
in  truth  value  as  a  result  of  the  dialing  action.    D5  says  that  the  Dial  action  is  primitive. 

Below,  we  present  the  proofs.  The  proofs  are  done  using  natural  deduction.  In 
addition  to  the  standard  rules  of  inference  [see,  e.g.  Mates  1979],  we  add  the  following, 
justified  by  Axioms  K1-K5: 

From  Know(a,pl...pn,s)  and  pl...pn  |-  q,  infer  Know(a,q,s). 

This  is  simply  the  consequential  closure  principle,  and  will  be  denoted  as  CCP. 

We  now  present  the  first  two  proofs: 

Proof  that  John  can  open  a  safe  if  he  knows  the  combination:  We  assume  that  John  knows  the 
basic  axioms  on  Dial,  that  he  knows  some  constant  for  the  combination  of  the  safe,  and  that 
be  is  at  the  safe.  We  prove  that  he  can  open  the  safe,  i.e.  that  he  knows  how  to  achieve  the 
goal  of  the  safe  being  open.    Our  proof  consists  of  three  parts.    First  we  must  show  that  John 
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knowshowto-pcrform  the  action  of  dialing  the  combination  of  the  <.afc  on  the  safe  (Steps 
1-6).  Ihis  is  casv,  since  Dial  is  a  primitive  operation  (Step  1),  the  particular  safe  is  a 
constant,  and  he  is  assumed  to  know  a  constant  for  the  combination  of  the  safe  (Step  5) 
Next,  wc  show  that  John  knows  that  the  physical  preconditions  for  dialing  the  combination  of 
the  safe  arc  satisfied  (Steps  7-11).  Since  John  is  assumed  to  be  at  the  safe,  he  knows  that  he 
is  at  the  safe(lO),  and  thus  that  the  physical  precondition  for  this  action  is  fulfilled.  Finally, 
we  show  that  John  knows  that  doing  the  dialing  action  will  result  in  the  safe  being  open(12- 
15),  thus  completing  our  proof. 

Problem  1: 

Given: 

Forall  s      Know(John,Dl.s) 

Forall  s      Know(John,D2,s) 

Exists  X      stidstr(xl)  and  Know(John,'Equal('x',Comb(Sfl),Sr,Sl) 

At(John,Sfl,Sl) 

Prove: 
Know-how-to-achieve(John,'Open(Sfl)',Sl) 


Proof: 

1.  Primitive-OperationCDial") 

2.  Exists  X  1  (stidstrfxl  ) 

and  Know  (John, 'EqualCxl  ■,Comb(Sf  1).S1  ',S1 ) 

3.  Equal(Sfl,Sfl,Sl) 

4.  Know(Jobn,'Equal(Sfl,Sfl,Sl)',Sl) 

5.  Exists  x2  (stidstr(x2) 

andKDow(John,'Equa!('x2%Sfl.Sl)',Sl) 

6.  Know-how-to-perform( John, 'Dial (Com b(Sfl),Sfl)', SI) 

7.  Know(John,Dl,Sl) 

8.  Know(John,  'Prccondsat(Do(John,Dial(Comb(Sf l),Sfl),Sl)    <  =  > 

At(John,Sfl,Sl))\Sl) 

9.  At(Jobn,Sfl,Sl) 
10.Know(John,'At(John,Sfl,Sl)',Sl) 
ll.Know(John,'Precondsat(Do(John,Dial(Comb(Sfl),Sfl)),Sl)\Sl) 


D5 

Given 

El 

3,E2,CCP 


KPl, 1,2,4 
Given 

7,CCP 

Given 

9,A1 

CCP,  8,10 
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12  Know(John.D2.Sl)  <J'^^" 

13.Know(John.'R(Do(John,DiaI(romh(Sfl).Sfl)),Sl,S2)  -  > 

Equal(Comb(Sfl),Comb(Sfl).SI)      >  Opcn(Sfl,S2)\  SI)      CCP,12 

14.Know(John.'Equal(Comb(Sfl),Comb(Sfl),Sl)",Sl) 

CCP,E1,E2 

15.Know(John,'R(Do(John,DiaI(Comb(Sfl).Sfl)),Sl.S2)  =  > 
Opcn(Sn.S2)',Sl) 

CCP,13.14 
16.  Know -how -to-achieve(  John,  'Open(Sfl)',Sl) 

KA1,6,11,15 


Proof  thai  if  John  knovis  a  safe  is  locked  and  tries  to  open  it  by  dialing  some  number,  he  nill 
know  after  he  does  the  dialing  whether  or  not  the  number  he  dialed  was  the  combination  of  the 
safe . 

The  proof  is  divided  into  rwo  cases,  which  are  proved  analogously.  In  Case  I,  we 
assume  that  the  number  John  is  dialing  is  indeed  the  combination  of  the  safe.  In  Case  II,  we 
assume  that  the  number  John  is  dialing  is  not  the  combination  of  the  safe.  In  either  case,  we 
show  that  John  is  aware  after  dialing  whether  the  number  dialed  was  the  combination  of  the 
safe. 

The  proof  of  Case  I  proceeds  as  follows:  Wc  assume  thai  John  intends  to  dial  a  certain 
number  on  a  safc(Stcp  1)  He  thus  knous  after  he  has  dulcd  that  he  has  done  the  dial]ng(2- 
3).  He  also  knows  thai  the  safe  started  out  closed,  and  that  therefore,  if  the  safe  is  open  in 
the  resulting  situation  he  dialed  the  correct  combination  (4-7).  He  knows  that  the  safe  is 
now  open(lO).  Therefore  he  knows  that  the  number  he  dialed  was  the  correct  combination 
when  he  dialed(ll).  By  the  frame  axiom,  he  knows  that  that  number  is  currently  the  correct 
the  correct  combination  (12-13). 

Case  I: 

Given: 

Forall  s  Know(John,Dl,s) 

Forall  s  Know(John,D4,s) 

Know(John,'Not  Open(Sfl,Sl)',Sl) 

Equal(Cl,Comb(Sfl),Sfl) 

Intend(John,Do{John,Dial(Cl,Sfl)),Sl) 


Prove: 

R(Do(John,Dial(Cl,Sfl)),Sl,S2)  =  > 
Know(John,  'Equal(Cl,Comb(Sfl),S2)'.S2) 
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Proof: 

1.  Intcnd{John.Do(John,Dial(Cl,Sfl)),Sl) 

2.  R(Do(John,Dial(Cl,Sf])),Sl,S2) 

3.  Know(John,  •R(Do(John,Dial(C],Sfl)),S].S2)',S2) 

4.  Know(John,D2,S2) 

5.  Know(John,'Not  Open(Sfl,Sl)',Sl) 

6.  Know(John/Not  Open(Sfl,Sl)',S2) 

7.  Know(John,'R(Do(John.Dial(Cl,Sfl),S],S2)  => 

Open(Sn,S2)  =  > 
Equal(Cl,Comb(Sfl),S])\   S2) 


Given 

Assumption 
11,1,2 
Given 
Given 
Given, D4,D5 

CCP,4 


8.  Equa](Cl,Conib(Sfl),Sl) 

9.  Open(Sfl,S2) 

](»  Kncm  (John.  Open!  Sfl.S:)\S2) 

l].Know(John,Equal(Cl,Comb(SfI).Sl)\S2) 

12.Know(John,D4,S2) 

13.Know(John,'Equal(Cl,Comb(Sfl),S2)\S2) 

14.R(Do(John.Dial(Cl,Sfl)),Sl,S2)  =  > 
Know(John,'EquaI(Cl,Comb(Sfl),S2)',S2 


Given 
D2.2,8 

D3.2.9 

CCP,2,6,7,10 

Given 

ccp,n,i2 

Discharge  2,13 


The  proof  of  Case  II  proceeds  along  similar  lines.  We  assume  that  John  intends  to  dial 
a  certain  number  on  a  safe(l).  He  thus  knows  after  he  has  dialed  that  he  has  done  the 
dialing  (2-3).  He  knows  that  if  the  safe  is  not  open  when  he  finishes,  that  the  number  he 
dialed  was  not  the  combination  of  the  safe  (4-5).  He  knows  the  safe  is  now  open  (8). 
Therefore,  he  knows  that  the  number  he  dialed  was  not  the  correct  combination  of  he  safe 
(9).  By  the  frame  axiom,  be  knows  that  the  number  is  currently  not  the  correct  combination 
of  the  safe  (10-11). 
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Case  II 

Given: 

Forall  s  Know(John.Dl  ,s) 

Forall  s  Know(John,D4,s) 

Know  (John, 'Not  Open(Sfl,Sl)",Sl) 

Not  Equal(Cl,Comb(Sfl).Sfl) 

Intend(John,Do(John.Dial(Cl.Sfl)),Sl) 

Prove: 

R(Do(John,Dial(Cl.Sfl)),Sl,S2)  =  > 
Know(John,  'Not  Equal(Cl,Comb(Sfl),S2)\S2) 


Proof: 

1.  Iniend(John,Do(John,Dial(Cl,Sfl)),Sl) 

2.  R(Do(John,Dial(Cl,Sfl)),Sl,S2) 

3.  Know(John,  'R(Do(John,Dial(Cl,Sfl)),Sl,S2)',S2) 

4.  Know(John,D2,S2) 

5.  Know(John.RiDo(John.Dial(ri,Sfl].Sl.S:)  -  > 

Not  Opcn{Sn,S2)       ;• 
Not  Equal(Cl,Comb(Sfl),Sir,    S2) 


Given 

Assumption 
H,l,2 
Given 

CCP,4 


6.  Not  Equal(Cl,Comb(Sfl),Sl) 

7.  Not  Open(Sfl,S2) 

8.  Know(JohD,'Not  Open(Sfl,S2)',S2) 

9.  Know(John,'Not  Equal(Cl,Comb(Sfl),Sl)',S2) 

10.Know(John,D4.S2) 

ll.Know(JohD,'Not  Equal(Cl.Comb(Sfl),S2)',S2) 

12.R(Do(John,Dial(Cl.Sfl)),Sl,S2)  =  > 

KDow(John.'Not  Equal(Cl,Coinb(Sfl),S2)',S2 


Given 

D2,2,6 

D3,2,7 

CCP,2,5,8 

Given 

CCP.9,10 

Discharge  2,11 
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Proof  that  John  can  perform  the  action  sequence  of  Read(combination):  Dialicombination.safe} 

We  will  now  show  that  John  can  open  a  safe  by  reading  the  combination  and  dialing 
that  combination,  even  if  he  doesn't  know  the  combination  of  the  safe  when  he  begins  to  do 
the  action.    We  begin  by  introducing  some  axioms  on  the  action  Read. 

RDl;  Forall  a,x,s 

Precondsat(Do(a,(Read(x)),s)  <  =  >  At(a,x,s) 

RD2:  Forall  a,xl,x2,sl,s2 

R(Do(a,Read(x2)),sl,s2)  and  Info(xl,x2)  =  > 
Know(a,'Info('xr,(5  x2)',s2) 

RD3;  Forall  a,xl,x2,sl.s2 

R(Do(a,Read(x2)),sl,s2)  and  Info(xl,x2)  =  > 
forall  p 
p/=  'Know(a,'lnfo('xr,(a  x2)')  and  p/=  'Not  Know(a,'Info('xr,(a  x2)'  =  > 
T(p.sl)  <  =  >  T(p,s2) 

RD4:  Primitive-Operation('Read') 


RDl  states  the  physical  precondition  for  performing  the  read  action.  It  simply  says  that 
an  agent  must  be  at  the  location  of  the  object  that  he  is  reading.  RD2  says  that  if  some 
information  is  written  on  some  object  -  we  assume  the  information  is  in  the  form  of  a  string  - 
and  an  agent  reads  that  object,  then  he  will  know  that  the  information  is  written  on  the 
object.  RD3  is  the  frame  axiom  for  Read  and  says  that  the  read  action  changes  nothing- 
except,  of  course,  that  an  agent  will  know  after  the  action  what  information  is  written  on  the 
object  that  he  reads.  RD4  states  that  Read  is  a  primitive  action,  which  is  not  a  true-to-life 
assumption,  but  is  a  useful  simplification  for  our  purposes. 

We  now  prove  that  if  there  is  some  piece  of  paper  that  has  the  combination  of  some 
safe  written  on  it,  and  if  John  knows  that  the  paper  has  the  combination  written  on  it,  that 
John  can  perform  the  action  sequence  of  reading  and  dialing.  We  first  show  that  John  can 
perform  the  action  of  reading  the  paper  (1-5).  This  is  easy  since  read  is  a  primitive  action  (1) 
and  he  knows  a  stidstr  for  the  paper  (2-4).  We  then  show  that  reading  the  paper  results  in 
his  knowing  the  information  on  the  paper  (6-10),  and  thus  in  his  knowing  the  combination  of 
the  safe  (11-15).  Since  he  knows  a  stidstr  for  the  safe  (16-18)  and  Dial  is  a  primitive  action, 
he  can  dial  the  combination  of  the  safe(20).    Thus  he  can  do  the  entire  sequence  (21-22). 
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R4 

El 
E2,CCP,2 

3 

KP1,],4 
Assumption 

Given 

rrp.7 


Given: 

Know(John, "exists  cl  (stidstr{cl)  and  equal(cl.comb(Sfl).Sl)',Sl) 

Prove: 
Know-how-to-perforni(John,sequence(Read(Pprl),Dial(Comb(Sfl),Sfl)),Sl) 

1.  Primitive-OperationCRead') 

2.  EquaI(Pprl,Pprl,Sl) 

3.  Know(John,'cqual(Pprl,Pprl,Sl)'.Sl) 

4.  Exists  xl  (stidstr(xl)  and 

Know(John,'EqualCxl',Pprl,Sl)',Sl) 

5.  Know-how-to-perform(John.'Read(Pprl)',Sl) 

6.  R(Do(John,Read(Pprl).Sl,S2) 

7.  Know(John,  exists  cl(stidstr(cl)  and  equal(cl,Comb(Sfl),Sl) 

and  info(cl,Pprl)',Sl) 

8.  Know(John, 'exists  cl  (stidstr(cl)  and  equal(cl,comb(Sfl),S]) 

and  info(c] ,Pprl ) 

and  inf(i(ci.PprI)      >  equal(cl  .comb(Sf  1 )  )'.SI ! 

9.  Exists  cl  (stidstr(cl)  and  equal(cl,comb(Sfl),Sl) 

and  info(cl,Pprl))  1^2  7 

10. Exists  cl  (stidstr(cl)  and  equal(cl,comb(Sfl),Sl)  and 

info(cl,Pprl)  and  know(John,'info('cr,Pprl)',S2)  RD2  6  9 

11. Exists  cl  (stidstr(cl)  and  equa!(cl.comb(Sfl),Sl)  and  info(cl,Pprl) 

and  Know(John,'cqual(*cr,comb(Sfl),Sl)',S2))  CCP  8  10 

12.Forall  x  (Equal(x,comb(Sfl),Sl)  =  >  Equal(x,Comb(Sfl),S2))  D4,6 

13.Know(John,D4)  Given 

14.Kaow(John,'ForaIl  x  (Equal(x.comb(Sn),Sl)  =  > 

Equal(x,Comb(Sfl),S2))',S2)  CCP, 12, 13 

15. Exists  cl  (stidstr(cl)  and  cqual(cl,comb(Sfl),Sl)  and  info(cl,Pprl) 

and  Know(John,'equal('cr,comb(Sfl),S2)',S2))  K4  n  14 

16.Equal(Sfl,Sfl,S2)  E] 

17.Know(John,'EquaI(Sfl,Sfl,S2)-,S2)  E2 

18. Exists  x2  (stidstr(x2)  and 

Know(John,'equalCx2\Sfl,S2)\S2)  17 

19.Primitive-Operation(Dial)  D5 
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20.  Know -how  to-pcrforml  John. Dial(Comb(Sf]),Sfl),S2) 

21.R(Do(John,Read(Pprl).Sl.S2)      > 

Know -how -to-pcrform( John, 'Dial(Comb(Sfl),Sf])',S2) 

22.Know-how-to-perform(John, 

sequencc(Read(Pprl,Dial(Comb(Sfl),Sfl)),Sl) 


KP1,15,18,1V 
Discharge  6.20 
KP3,5,21 
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